Do not block local requests.

Local requests do not include the `x-forwarded-for` header and should just be allowed.