use the real ip to decide whether to allow pathOnly

the server may get the ip of the end user through XFF if the domain is
whitelisted