Lets federated sign-in reach instances on private addresses, localhost among them, and over plain http (GERBEUR_FEDERATION_ALLOW_PRIVATE=1), so that two instances on one machine can trust each other in development. Off, remote/gerbeur-instance.ts reaches only public https instances, since an identity is only as safe as the connection it came over.