session: allow local host binds