You need to run it from a web server. Open a shell on the root directory and run `python -m SimpleHTTPServer 8888` on it. Browse to `localhost` on 8888.
I'm not entirely sure of the class of attack that it prevents, but it's been that way for quite a while now.
Tada, access to local files, or unlimited XHR requests for DDoSing, etc. :-)