As far as I know, localhost can't be intercepted. Except for unintentional mistakes such as binding to 0.0.0.0 instead of 127.0.0.1. And inevitably there are going to be some tinkerers who'll run it over the network because it suits them.