add IP filter, first try, only some codes from server.js.orig