Fix localhost development by adding ALLOW_LOCALHOST flag

[Ernest-Gray]

Problem

• local development was broke due to cookie settings
• CORS issues persist but can be ignored if you run chrome with --disable-web-security
  • Only use --disable-web-security for localhost development, do not browse the web with this setting on
• the stage name was not properly setup for redirect urls

Solution

• Added ALLOW_LOCALHOST env var that can be set to true if developing
  • this correctly sets the cookie permissions so the auth cookie can get propegated to the backend
• The redirect url is also corrected if localhost so the redirect after authentication is correct

Testing

• Validated that the fix works with ALLOW_LOCALHOST=true
• Validated that the problem persists with ALLOW_LOCALHOST=false (this is expected for production deployments)
• testing done with running chrome with --disable-web-security to disable CORS related issues
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir=C:\chrome-dev-data\ --disable-web-security

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.