Allow application to work with localhost calls

[yarl]

Right now api is rejecting calls from localhost.

Access to XMLHttpRequest at 'http://tools.wmflabs.org/montage-dev/v1/admin' from origin 'http://localhost:8000' has been blocked by CORS policy: The response is invalid.

We should allow it, so there is no need to set up database and run local app when client app is on localhost. As a security thing, we can add extra param with secret word that will be posted in GET/POST headers.