[james, nimrod] added localhost to allowed origins