Fix: After one request with authorized IP, auth was permanently disabled because authNeeded boolean was stored in parent scope.
Some hints for the casual JS developer. ;)