`current_sign_in_ip` could become stale if the user has not logged out.
It should only be used as a fallback if request IP address can not be
resolved from the request context.

To avoid issue of injecting a wrong IP address, we are no longer
accepting this information when invoking the `AuditEventService` and
`Auditor`.