It looks like the behaviour here is that "get_userid" and "ipaddrs" are mutually exclusive, is that correct?  I think it might be neater and/or less surprising to the user if they are additive, e.g. the "ipaddrs" set is used to filter whether the request matches, and *then* the request is passed into get_userid() if present.  Thoughts?