Restrict client.ip and client.identity to req processing to avoid
the predictable panic if they are accessed from the backend side.