update readme, protect internal call
ignore localhost requests