Validate environment token if global auth is disabled
Allow localhost as whitelist host