test ip-based access (access denied case)