permit local api requests without auth