new recommended default: proxy allowed from localhost

[slingamn]

This is a pain point for websockets. Hard to see how it could cause any problems.

[DanielOaks]

Yeah this... makes sense. I'm always a bit paranoid about changes like this, but realistically the only way this could be 'exploited' is if someone is already on the same machine and can open connections, which is already a weird setup to have. In that sort of setup (like the tilde.* stuff), this would only give peeps the ability to give themselves weird fake hostnames anyway which'd be sniffed out right away.

I feel like this is fine. Buuuut maybe we should add a warn/info line to startup that says something along the lines of:

Proxying allowed from localhost

for specifically the case where localhost is allowed as is done here, to notify admins that happen to miss this config section.