allows localhost urls