accept a broader definition for localhost when determining whether a password is needed (e.g. using the public ip is now accepted)

oops that should not be here!  thanks