accept a broader definition for localhost when determining whether a password is needed (e.g. using the public ip is now accepted)
This closes #174