always enable CORS when running locally

@hjfreyer @jtolds Is this an OK thing to do? Just trying to make dev a little easier