allow Origin: localhost (for karma e2e tests)