This page reads data from NBA's SSO server cross-origin. The server reflects any origin containing "localhost" into Access-Control-Allow-Origin with credentials allowed.