Rename "localhostAccessOnly" policy to "sameOrigin" and improve how it works.