[auth] don't require basic auth if on loopback

If we are listening on loopback, we are not world reachable, so we don't require basic auth.

TODO
* This doesn't actually bind on the "host" address yet.