use the real ip to decide whether to allow pathOnly

the server may get the ip of the end user through XFF if the domain is
whitelisted
Merge pull request #1642 from kaltura/IX-9.19.1-path-only-use-real-ip

use the real ip to decide whether to allow pathOnly