In a normal environment, `localhost` should not be a valid domain name. Why can't we just let the user configure the whitelist themselves? Why should validators default to having localhost as a valid domain name?