ClientAddressAuthorizer accepts comma-separated patterns in a single String