Use IP not localhost

The `cors-anywhere` module does some checking against the proxy hostname and it does not consider `localhost` to be valid. This is dumb. To work around this, we replace `localhost` with `127.0.0.1` which matches the `cors-anywhere` validity check for IPv4 addresses.
i dont know .js, but should both the ``/`` be escaped or not consistently?