allow localhost on -dev