diff --git a/server/auth-session.ts b/server/auth-session.ts
index fb3bef5..6eacead 100644
--- a/server/auth-session.ts
+++ b/server/auth-session.ts
@@ -286,7 +286,9 @@ export function isIpAllowed(
       if (subnetNum !== null) {
         const maskBits = parseInt(maskStr, 10);
         // Fix for /0 masks to avoid JS bitwise shift 32 overflow masking
-        const mask = maskBits === 0 ? 0 : ((0xffffffff << (32 - maskBits)) >>> 0);
+        const mask = maskBits === 0
+          ? 0
+          : ((0xffffffff << (32 - maskBits)) >>> 0);
         if ((ipNum & mask) === (subnetNum & mask)) {
           return true;
         }
@@ -299,6 +301,10 @@ export function isIpAllowed(
     }
   }
 
+  return false;
+}
+
+/**
  * Validates a given URL to ensure it is safe to redirect to.
  * Allows relative paths, localhost, and *.atyg.org (or custom RP_ID)
  */
diff --git a/server/main.test.ts b/server/main.test.ts
index 9d5afb7..1fdfbd3 100644
--- a/server/main.test.ts
+++ b/server/main.test.ts
@@ -520,20 +520,6 @@ Deno.test("Tier 1 & 2: POST /api/guests/sandbox - Creates guest session", async
   assertEquals(data.success, true);
   assertEquals(true, !!data.sessionId);
   assertEquals(true, !!data.guestUuid);
-  const origRpId = Deno.env.get("RP_ID");
-  Deno.env.delete("RP_ID");
-
-  try {
-    assertEquals(getCookieDomain("auth.atyg.org"), ".atyg.org");
-    assertEquals(getCookieDomain("ed-droid.atyg.org"), ".atyg.org");
-    assertEquals(getCookieDomain("atyg.org"), ".atyg.org");
-    assertEquals(getCookieDomain("localhost"), undefined);
-    assertEquals(getCookieDomain(""), undefined);
-  } finally {
-    if (origRpId !== undefined) {
-      Deno.env.set("RP_ID", origRpId);
-    }
-  }
 });
 
 Deno.test("Logout Return-Path Validation", async (t) => {