don't prevent login if IP address is unexpected

- need to review if we should default to 127.0.0.1