What are the odds that a website will run a computationally hard hash function on every single HTTP request just so it can log something less sensitive than an IP address?