allow localhost in urls