Source IP whitelist test origin
/ip-deny
— real HTTP 403 with source-IP allowlist language and x-denied-reason header.
/generic-403
— generic HTTP 403 that should not show the discovery page.
/ok
— normal 200 response.