don't allow localhost by default