allow middleware on localhost