Only allow credentials requests from the localhost. Fixes #40