use the real ip to decide whether to allow pathOnly

the server may get the ip of the end user through XFF if the domain is
whitelisted
Merge pull request #1639 from kaltura/IX-9.19.2-path-only-use-real-ip

use the real ip to decide whether to allow pathOnly