add IP whitelist to local endpoints
aborting non-authorized request with a 403 not 401
resolving bug in CTE part of stats query