Django ALLOWED_HOSTS: OK to include 'localhost' on a deployed settings file?

In Django 2.1.4, another solution is: ALLOWED_HOSTS = ['127.0.0.1']

As long as the app does not give superpowers to requests with 'localhost' in the Host http header it should be ok.