Chrome has an exception for requiring tls on localhost for certain services. That, plus an extension to disable CORS on it has gotten me as far as I've needed (so far). What roadblocks have you come across?