code: protected boolean isFromLocalhost(HttpServletRequest request) throws MalformedURLException {
          String host = new URL(request.getRequestURL().toString()).getHost();
          return host.equals("localhost") || host.equals("127.0.0.1") || host.equals("0:0:0:0:0:0:0:1");
      }
docs: We cannot rely on request.getRemoteAddr().
  Caller must use the loopback host.