[web2py] Admin security: https vs localhost

[pbreit]

>From the code, it looks like admin is accessible via https *OR* localhost. I 
had thought localhost was a requirement by default since otherwise it seems 
too easy to break in to admin by just trying a bunch of passwords. Or is the 
advise to not use https in order to require localhost?