add warning for nonlocalhost clients visiting localhost app