Add localhost as valid origin for a CORS call

This fixes #62