- add localhost to default whitelist