Allow-Origin is by default localhost