Yes, localhost IS the exception. There is a lot of code that treats "localhost" specially. IIRC Chrome will let you do things on localhost:XXXX that are normally only possible for sites over HTTPS (Think geolocating and some other privacy-related things).