This seems unsafe to me. What if you don't set up htpasswd rules and someone sends an Authorization header? I suspect apache will let the request through, and then this will execute it. IMO it might be better to let the `$options['ip_whitelist']` be `'*'` and if it's that just let everything through. That way you can configure it that way if you are sure you secured it some other way.