Preface: We're running an API back end with JS-framework front end for our website. They will be running on the same box and we have no need for the API to be available via a publicly exposed hostname.
That being said, if we're using this in production, is it superfluous (security-wise) to use TLS for our localhost application? For the sake of being thorough, let's assume that the LAN is not secure. However, we do have a hardware and software firewall on our LAN.