Investigating middleware, responses not enabled though.
CSS was rebuilt because of timestamp or something, i don't know why.
Added WpBanIpMiddleware and enabled it.

New request middleware was added, WpBanIpMiddleware.
It looks for regex strings in a 'wp_banned.lst' file,
compiles them, and then checks them against the
request's ip address.

If no file exists, or the file is empty, the middleware
is short-circuited and nothing happens.

If the file exists, and the regex is compiled, the request
ip is checked against all the patterns. When an ip matches,
a very plain (on purpose) 403 code/page is returned.
I don't want to render templates for a user that I most likely
don't want on my site. They could be bots, repeat-offenders,
script-kiddies, etc. and I don't want to waste the cycles on them.

P.S. - The WpCleanResponseMiddleware is very slow, and therefor
disabled. Maybe in the future it can be added in such a way that it
works. (Right now its in the form on template rendering functions,
which only has to parse small amounts of html (not everything else.).