admin area can be force to only be accessed from an ip

We can now force a user to have to VPN in to use the admin.  This plus
the honeypots and what not should keep the risk as low as we can go
moves the ip filter to after the honeypot

we still want to try to log and filter those.. good for reporting later