nginx: allow local requests without needing to auth