After having trouble getting the default swat setup to work, as well as reading several postings on the forums about not being able to connect for cups configuration, etc., I realized the problem: No route is being added for 127.0.0.0/8 to use the lo interface. Therefore, when connecting to services on 127.0.0.1, the source IP is seen as the IP of a real NIC (typically eth0). Anything configured to only allow from 127.0.0.1 is then blocked (like swat, cups, etc.). The easy solution (to me, anyway), is to add a line such as: /sbin/route add -net 127.0.0.0 netmask 255.0.0.0 gw 127.0.0.1 dev lo right after the /sbin/ifconfig line in start{} in /etc/init.d/net.lo.
Added to CVS, should be in baselayout-1.8.6.3, thanks.