Allow “localhost” as long as it actually resolves to a localhost addressgithub.com/w3c2 pointsbased210 years ago