$PUBLIC_URL : reject "localhost", it will only bring tears

We must use "127.0.0.1" instead, since that's what fxa-auth-server/Hawk
are using as a "hostname", and it's included in the HMAC'ed request.