add localhost to permitted origin