Allow cross-origin API requests from local sites