The rpcallowip setting is not needed in the web demo's config.txt file. You don't need to worry about the IP addresses of the users of the web demo, because its PHP code will process the users' requests, and then this PHP code is what calls the MultiChain API – not the users directly. If your web server and MultiChain node are running on the same computer, by default MultiChain will accept the requests from the web demo without setting rpcallowip.