Personally, for the last point, I just use a disable CORS extension on my browser for local dev work, and any http-server.