moved the plugin execution into an after_theme_setup action so we can make sure whitelisted IPs can be defined