It seems that unless you put the following in ui.allow:
... lfd won't allow browsers on localhost to connect (connection is reset). As localhost is automatically whitelisted in other places with CSF/LFD, surely it should be auto-whitelisted for the UI?