The current documentation on what localhost matches and the differences on how it matches on different operating systems is not documented clearly enough. The current documentation is as follows:

Host name matches are case-insensitive. Host names can match either domain names or IP addresses. Use 'localhost' as the host name to allow only local client connections.

This is not clear enough as localhost is often defined to point to the loopback adapter and connecting via 127.0.0.1 will not be treated as coming from localhost on Linux. On Windows both TCP connections to 127.0.0.1 and connections from named pipes are treated as coming from localhost.

Here's my attempt at a clarification on this:
Use 'localhost' as the host name to allow only local client connections. On Linux, the loopback interface (127.0.0.1) will not match 'localhost' as it is not considered a local connection: this means that only connections via UNIX-domain sockets will match 'localhost'.