In general I think browsers should prevent websites reaching out to localhost without explicit opt-in from the user.