IP addresses are not easy to spoof. Most ISPs do egress filtering, and most TCP stacks use cryptographically-secure sequence number generation. This makes forging HTTP traffic nearly impossible in practice.