These endpoints are actually called via JS and thus are not only local
    
    Marking these endpoints are localonly will prevent them from working on
    deployed instances since then it's the user's IP that provided.