added allowed.js, separated ALLOWED_IP from index.js