allow localhost redirects with config value

fixes #144 
It would match that, and it would require the dangerous config to true also.

It's not hard to improve the test tho. I'll change it to parse the url and confirm `url.hostname` is a direct match.