The url will be something like localhost I guess. You can make your own web server, put there an image and check how the host looks like when it is requested by jsreport/chrome.
I think should IP addresses for the restriction. The url isn't secure anyway. The ip address will be the same as your EC2 ip.