Apologies if this should actually be a feature request rather than a 'bug'.

I have had a peculiar issue where order confirmations have been failing after a
successful confirmation received back from the payment gateway. I identified the
issue as being caused by a change of IP address from when the payment was sent
to the Payment Gateway compared to when the successful response was received
back.

The issue is because the IP address is part of the key used in orders_helper
get_security_key line 159. The IP address was changing regularly with one person
testing on a smartphone and the client had a (very) dynamic IP address
allocation in their office network that would change many times an hour. There
has also been 2-3 times per year (over 3 years) when the same situation
happened: customers payment successfully taken but order not set to confirmed in
Order Manager and confirmation emails not sent. It's not definitive that this
was caused due to an IP Address change but without the data it's my best guess.

I am not sure how much of a security issue it would be to remove the IP address
from the key. But if not a big deal it would remove a small potential for
processing errors.

Many thanks

Chris