allow_local_remote_servers must be true at the system level in order the app can work

[ostasevych]

I have found that the option allow_local_remote_servers option in the config.php must be set true, in order the app can work.
Otherwise it says:
OCP\Http\Client\LocalServerException: Host violates local access rules

I tried to limit the option to only this app, but it doesn't work, and needs to be set true at the upper level in the config.php file.

Is that secure? Especially, if I do not use federated API at all.