add middleware to allow all local requests