Set CORS globally.
Use localhost webapi on dev env.