accept a broader definition for localhost when determining whether a password is needed (e.g. using the public ip is now accepted)

Would be good to have tests for this. There are no unit tests for `Networking.isLocalhost` currently.