Respecting whitelisting for localhost requests