I would suggest that if SelfCheckoutByLogin is set to cardnumber, that SelfCheckAllowByIPRanges be enforced, and if the selfcheck is accessed at an IP not listed in SelfCheckAllowByIPRanges, that SelfCheckoutByLogin ignore the setting and act as if it is set to username/password.