Respect a requested PortalIP if possible

This will make DNS possible on a static IP.
Fair enough.  I can change this - get rid of NewForbidden entirely?