Do you have a cluster? The FGT in a cluster uses 127.0.0.1 and telnet now that I think about it. Never seen http and the localhost in a admin auth messages.
Also add, make sure you do not have a fortiexplorer hooked up to the Fortigate, it also uses 127.0.0.1 and telnet. I bet this is your case and something is triggering because of this.
Yes i have cluster and i try to find how to disable fortiexplorer or some thing related this behavior i can not found.
do you have recommend to do this.