Only inject requests to 'localhost'.

Closes #2.