I'm not an expert, but HTTP travels over TCP and, if I remember correctly, TCP uses sequence numbers to prevent IP spoofing.