add simple localhost whitelist