Still need to know where the top-level page is loaded from, though: you do want to allow requests from 127/8 to "localhost".