Restrict /server-status to just localhost