Updated IP blacklisting.
auth: null x-forwarded-for should not call `next`