secure local development, no need to disable CORS