xhr now is permitted on localhost