Comment by jessikat

Even on localhost, you should still use auth. One shouldn't naively assume someone can't break into your server.