Secure localhost registry (carry of #8898)

This carries @proppy's localhost registry patch but makes one big modification: all 127.0.0.1 registries are always treated as insecure.

/cc @tiborvass 
I blame git rebase. Will do later today.