Move grant and IP restriction logic from OAuth to core