I know it's Google's fault, and not the author's, but creating an environment where users need to run a web server to access local files strikes me as extremely stupid. I can't imagine a situation where this is more secure than a proper API could be, and I can imagine several situations where it isn't (e.g., if the server has a security vulnerability, or more trivially, if there are multiple users on the same machine and the data is private).