Let amp-toolbox-cors allow localhost

We'd like to use amp-toolbox-cors in its default configuration, where it only allows requests from known AMP caches. Unfortunately, if we do, this means that requests from localhost will fail. And, as far as I can tell, they fail silently. The server just doesn't work.

Currently we're just doing this:
```
app.use(ampCors({
verifyOrigin: false
}));
```
which of course is not ideal :)

Would it be worth allowing requests from localhost by default? Or letting the user specify an array containing additional trusted domains?

/cc @demianrenzulli @antoinebisch

Start by locating the amp-toolbox-cors package and its default origin-verification entry point. Reproduce the localhost request failure with the default configuration, then compare the two requested outcomes: allowing localhost by default or accepting additional trusted domains. Done means the chosen behavior is documented and covered by tests.

Written by the indexing model from the issue text.