What if a bot uses user-agent to look like it came from an end-user browser?