fix(security): _is_loopback must check direct TCP addr, not headers

fix(security): _is_loopback must check direct TCP addr, not headers #18