add some basic protection for /api based on source IP