The daemon has now been set to allow the origin to be from everywhere, which means Cross-Origin Resource Sharing (CORS) does not need turned off in the browser. The reference I used to do this is over seven years old so if someone has a different idea please suggest.
The files I used to do this are in RPUpi/WSGIdaemon at e29239e4391a8bb64c23b63f60e7901c8e0ae7e9 · epccs/RPUpi · GitHub