ws: Don't redirect to TLS when accessing as localhost

Allow localhost to access over pure HTTP. This makes demoing and
testing cockpit easier.

Closes #400