allow access from localhost without authentiaction