Oh right, I had the same thought but forgot about it again. What about keeping it simple and just change the `localhostRepresentations` to:

    localhostRepresentations = []string{"http://127.0.0.1", "http://localhost"}

That should be save.
Even if it's part of a url, this wouldn't be possible: http://example.com/?url=http://localhost - since it would have to be urlencoded and wouldn't match.