Allow localhost on CORS