They come untrusted from the client. Trivial to fake, and often stripped at security gateways or mangled by proxies.

-- Randal L. Schwartz, Perl hacker