`CORS_ALLOWED_ORIGINS` contains `localhost` in shared `.env.backend.example`

[deyna256]

The example env file intended as a prod template includes a localhost origin that should only appear in a dev-specific file.