replSetReconfig is allowed with the localhost exception, so it's odd (and causes some testing headaches) for replSetGetConfig to not be allowed.

With Initial Sync Semantics, users may want to call replSetGetConfig more to get the current config version when creating new configs. For reconfig to be safe, you can only add one node at a time, so you may need to do more back to back reconfigs. You also need to call replSetGetConfig with the "commitmentStatus" to know when your current reconfig is committed.