Add ACAO header to let localhost in on the action