Restrict WebSurface to non-local http + https requests