allow local requests bypass token