Remove forced ssl upgrade for localhost http requests

[jglukasik]

I've been playing around trying to glue urbit and IPFS together. For my first iteration, I tried to +curl my local IPFS API from the Dojo. Because go-ipfs doesn't implement HTTPS, I made sure to do a +curl "http://localhost:5001...", but I was still getting an ssl related error:

> +curl "http://localhost:5001/api/v0/get?arg=QmagqTLSZvdqjWp2hVFokDyThekNAACsUG8r2XGhBWPQh6"
< http://localhost:5001/api/v0/get?arg=QmagqTLSZvdqjWp2hVFokDyThekNAACsUG8r2XGhBWPQh6
http: fail (170, 504): ssl handshake failure
HTTP 504

Talking to @Fang- at the last meetup, he reassured me this should not be happening, and specifying "http" should do a regular non-ssl request. I dug in a bit and found the issue: in the definition for ++ auri there is a conditional to check if this is a localhost request (using ++ hoke), and if so, it forces it to use SSL.

This PR removes this forced upgrade, so i can specify either an http or https request to localhost.

There might be a reason for this check, but I couldn't find one. I did some git spelunking and found that this was added in commit 2c3c4c8 , so maybe @cgyarvin knows if this is still needed or not.

Also, I don't fully grok the implications of creating this "iron gate" here; I cargo-culted from a similar-looking ++ aurf definition above and it worked :)

[Fang-]

That was fast! I said I'd insta-merge, but I have a question about your specific implementation, maybe it can be simplified further.

Also, @cgyarvin, you put the forced-secure in like 2 years ago. If you can recall a good reason for it, speak up now.

[Fang-]

Perfect, thanks so much!

I'll give @cgyarvin a couple days to respond, and then merge. (:

[joemfb]

I've assumed that this was related to the way in which user-agents treat localhost as a secure origin (for certain web apis, mixed-content warnings, etc.). But it's a major pain when it comes to making requests instead of receiving them. Maybe we still want to include something similar in the latter case, but definitely not in the former. Thanks @jglukasik!