patch x2gosessionlimit to only allow session creation from localhost