Strange --dav-auth behaviour

### Describe the bug
--dav-auth is required to actually accept password instead of authing as anonymous, but user still can be authorized to dav even without that option by IP

### To Reproduce
Add copyparty without --dav-auth flag as webdav in cx explorer 2.3.4. No matter the password user you will be authed as anonymous, unless your IP is mapped to specific user

### Expected behavior
It not ignores password without --dav-auth or also ignores IP

### Additional context
Keep in mind that some dav clients aren't allowing even trying to connect without password. Trying to login as not user mapped to client IP wasn't tested.
Even if --dav-auth meant to allow auth, not force, authorizing by IP bypasses it.

If you don't get how wrong it feels:
Known ip + right password: OK
--dav-auth from allowed ip: OK
--dav-auth from unknown ip: OK
unknown ip + right password: FAIL (uh???)
unknown ip + wrong password: FAIL (obviously)
--dav-auth with unknown password: refused

where OK is being authorised to desired profile and FAIL being authorised as anonymous

In my situation leaving house (and switching to mobile nerwork) was unauthing me even with right password until I enabled --dav-auth. Even if that's how it should've been that behaviour is unexpected

Look at the WebDAV authentication logic in the codebase, likely in a module handling HTTP or WebDAV requests. The issue describes that --dav-auth flag changes password acceptance but IP-based auth bypasses it. Start by finding where IP mapping and password auth are implemented, and see how they interact. Test with a WebDAV client to reproduce the described behavior, then adjust the logic so password auth works consistently regardless of IP mapping.

Written by the indexing model from the issue text.