Hacker News Reader

Why not have the REPL (or whatever else you're exposing to localhost) require a token for authentication of each request?

Because it's usually a raw socket, not an HTTP interface, so that's kind of tricky. But it could work.