check for explicit identity and "localhost" to avoid loopback faces