Adding localhost here is best practice according to the web. I want to find out *why* it's required, though, as it'd be even better if we can tighten this down. This, though, shouldn't affect the ability to merge this PR. It's not a security hole etc. aiui.