Function is_loopback_redirect 

fn is_loopback_redirect(redirect: &str) -> bool

Whether redirect names a loopback address on the machine running the command — the only place this server will hand a session it just minted.

A command line waiting on http://127.0.0.1:<port> is the case this exists for. Anything else is somebody else’s address, and sending an operator session to it is the whole of an account takeover, so the test is a allowlist of the three spellings of “here” rather than a search for anything suspicious.