A user agent is a claim, not proof. The network a request came from is harder to fake than the string it sends.
Read the full version