move localhost guest access in front of catch-all localhost access