make me@localhost:8001 / http-hosted apps restriction clearer, closes #22