Enforce IP restrictions for header-based authentication

IP allowlist validation now runs for all authentication paths, covering header-based auth that previously bypassed the check.