Other answers are fine. But in my case, I was working on a Windows box that already was running some old IIS, IISExpress or any other web site. What happened is urls ACLs where reserved somehow in the system. So, you might want to check this.

Here is the console command to dump all URL acls:

netsh http show urlacl

Check what's returned here, and if anything matches the url you are testing, here is the command to delete one URL acl (for example):

netsh http delete urlacl url=http://localhost:2018/

(beware to carefully note what you do here in case it was not related to the original problem)