All occurrences of "REQUEST.REMOTE_ADDR" should be replaced with "REQUEST.getClientAddr()", because REMOTE_ADDR could contain some proxy address only.