accept a broader definition for localhost when determining whether a password is needed (e.g. using the public ip is now accepted)

agree ... but the only meaningful tests would be runs on lots of different machines