Fixed
http://[::1]:…no longer produces the "plain http to a non-local host, the
API password will be sent unencrypted" warning.URL.hostnamekeeps the
brackets around an IPv6 literal, so the loopback check never matched that
notation.
http://[::1]:… no longer produces the "plain http to a non-local host, theURL.hostname keeps the