hardcoded allow ip (temporarily)