[dev] disallow localhost as host

[EverlastingBugstopper]

for now it rick rolls you so we should limit that behavior until we solve #901

[jayphelps]

This nearly gave me a heart attack 🤣 I thought at first I had been hacked.

[EverlastingBugstopper]

next release of the workers runtime will no longer rick roll and will provide a meaningful error message, so this issue should no longer be relevant 😄 #901 is still a good idea though i think

[kentonv]

@jayphelps Sorry! My fault. I put in that code three years ago to catch people testing SSRF attacks on cloudflareworkers.com (trying to talk to "localhost" on our server, maybe hoping to find an unprotected internal service), but I guess with wrangler dev it's now much easier to hit it by accident.

[jayphelps]

Totally. No worries on my end at all. 👍