Move remote_ip check in front of token acl check.