Often you want to expose your library publicly, which requires
authentication to prevent unknown users from seeing your
content.
In my case, I also expose the library on a local domain using a local DNS server which doesn't have these security issues.
This change adds a `local_only` option to the feed auth
config which will only supply the provided username/password
when the request comes from a private IP address.
Omitting `local_only` or setting to false will keep the current
logic of sending the credentials no matter the origin of the
request.