Factored out isDefinitelyAllowed/isDefinitelyAllowedOverride. Allows subclasses to inspect ServletRequest to determine whether it is "definitely allowed", even if it is not on the IP address whitelist.