Allow local requests to pass by unauthenticated