allow requests within the same host only