Site permissions pattern matching

How on earth do I use this? 

I want to add a exception such that all localhost sites are allowed, irrespective of origin. How do I do that. In general, what form of pattern matching is going on here?