[auth] don't require basic auth if on loopback

[auth] don't require basic auth if on loopback