To follow up: the solution is that the localhost server needs to make sure each API call is authorized (if you aren't already). This means there must be a login/setup step.
An API call can't be considered authorized just because it came from localhost :)
An API call can't be considered authorized just because it came from localhost :)