In 7.22beta this rule has been updated with more conditions:
/ip firewall filter
add chain=input action=accept src-address=127.0.0.1 dst-address=127.0.0.1 \
in-interface=lo comment="defconf: accept to local loopback (for CAPsMAN)"
No idea why the extra checks are need.