Allow CORS from localhost

Kind of vital to allow for local development...