Why do I need a token on localhost now

The wizard generates a gateway token by default (even on loopback) so local WS clients must authenticate. This blocks other local processes from calling the Gateway. Paste the token into the Control UI settings (or your client config) to connect.
If you really want open loopback, remove gateway.auth from your config. Doctor can generate a token for you any time: openclaw doctor --generate-gateway-token.