We never use plaintext http so that is a reasonable thing to remove for our first-part domain (pushbullet.com).

We use localhost to communicate with our desktop application. An example is preventing both our extension and desktop apps from showing notifications on the same computer (our apps are all about notifications so this would get unacceptable very fast). Maybe if we limit it to just the local port we use? Seems like it can't hurt to try that too.