Comment by gayprogrammer

I'm thinking that arbitrary domains should not have access to any resource on '127.0.0.1', for the same reason that browsers restrict access to resources at 'file://' without user permission.