[auth] don't require basic auth if on loopback

If we are listening on loopback, we are not world reachable, so we don't require basic auth.