My thinking is that `_api_request_allow()` should adhere to the options passed to `api-server`. If someone starts the api-server command with specific requirements for HTTP host and IP address, then incoming requests should have to meet those requirements.

Later on in api_process_request(), however, custom commands can use the drush_api_process_request_alter() to look at the IP, host, and request, and decide whether the request can proceed or not.