Make IP whitelist optional

Not every implementation is going to need an IP whitelist.

Other changes:
* Moved non-action methods in `ApplicationController` to `private`
  for security reasons. Only actions should be public methods on controllers.