Function only_loopback_callers 

async fn only_loopback_callers(
    enabled: bool,
    request: Request,
    next: Next,
) -> Response

Refuses a caller that is not on this host, when this deployment answers only callers that are; see AuthState::loopback_callers_only.

A request that arrived with no peer address — a test driving the [Router] directly, or a deployment that wired neither crate::serve_router nor crate::serve_tls — is served, the same posture crate::rate_limit::caller_key takes for the same absence: this cannot tell such a caller apart from any other, and refusing every request on a router nobody put a listener under would make the router untestable rather than safe.