Outbound policy for the backend fetcher.

Allowlist: http://127.0.0.1:8000/ and paths under it.
Anything else is not fetched.
A prefix of the text is not enough: the card compares the scheme, host, and port
as separate parts. This lesson does not send either URL.

Browser page loads that the browser makes for itself are outside this allowlist.
Those loads are the browser's own requests.