Working for localhost only

The origin header MUST be set correctly for credentialed requests to work
Refactor of header setting