A per-address budget is inert where the server never sees an address, and says nothing #563

On a deployment where the server never sees a caller's address, the budget that bounds failed client authentications counts nothing and refuses nobody. It is keyed by the address the request came from, and that address is absent whenever the connection carries none (a unix socket, for one) and no forwarded header has been resolved into one. The budget is then switched on and inert, which is the state hardest to notice: no error, no log, and a configured limit that never fires.

Counting those requests together under one name is not the answer here. Nothing shared stands behind this budget for such a sender to spend, so a single bucket would buy no protection while letting one sender close every endpoint that authenticates a client to everybody arriving the same way, which on such a deployment is every caller. The user code cap makes the opposite choice for the opposite reason: a server-wide budget stands behind it, and leaving those attempts uncounted would let them spend it. So the behaviour is deliberate, and what is missing is that nobody is told.

What to decide:

• whether the server should say so, once, when the budget is enabled and the first request arrives with no address that can be named, rather than staying silent
• or whether stating the prerequisite in the settings documentation is enough, so that a host behind a proxy resolves forwarded headers before turning the budget on

The same absence applies to the budget a public client's revocation request is charged to, which is keyed by the client identifier and the address together and charges nothing when the address cannot be named.

Found while working on #326.