local.mho: allow CORS only from master host