don't complain about localhost when checking security of index links

Based entirely off of Guy Rozendorn's work in PR #1718 and resubmitting so it can be bloody merged.