The IP used by frontend can be different than the real endpoint, and unknown
for the frontend itself, so make it catch-all to allow access.

/reviewed-on !497