Allowed web origins no longer accepts localhost origin

Updating it via the management API does indeed still work, thanks!