Security fix: do not use $IP on include (thanks brion)