When templates are proxied via smart-proxy, HTTP header called X-Forwarded-For is added to each request. This allows to match the host via IP address when tokens are disabled, but Foreman does not honor this HTTP template which leads to 404 in these cases.

Kickstart does work tho since it is using the special HTTP_X_RHN_PROVISIONING_MAC_ header, but this shell work for other kinds as well (e.g. finish type).