When the default policy for the iptables INPUT chain is set to DROP, why should a rule allowing traffic to localhost exist?