move ip behavior module ahead of robot mitigation module

The sequence is: IP blacklist -> ua whitelist -> ip behavior -> rm -> session -> cookie poisoning -> naxsi / modsecurity ...