In my experience, it's http://localhost that is considered secure, but not http://127.0.0.1. This may have changed since I last checked.