AppSec only mode

[LaurenceJJones]

Currently to use this bouncer you must configure it to do IP checks. However, a user may want to disable the IP checks and only use the appsec code.

So my initial thoughts was changing how enabled flag works, however, this could be breaking if users use it in the old intended way.

However, to know if a user wants to use AppSec part we check if the url is configured. We could just use the same logic for the IP checks if LAPI url is configured then do the checks.