Allow 'localhost' to be used as a valid origin