use config instead of absolute localhost urls
do appropriate origin set and check for oauth postMessage