restrict access to /helper-server to localhost via http only