i'm trying to allow another host (a local host, like javascript.dev) to make a xhr to this host, i