-allowlocalhttp works for WebSurface in editor only. Also limit Http local http to editor and headless (dedicated server), players should never be able to accidentally opt in Facepunch/sbox-issues#5774