WEB 安全域名设置后调用返回403 Forbidden 怎么破？

安全域名设置为： http://localhost:40003

访问地址：http://localhost:4000/2016/06/22/%E5%BC%80%E7%AF%87/

用的是美国节点，访问经过了一次307，信息如下
https://api.leancloud.cn/1.1/classes/Counter2
状态码：307
请求头：
Host: api.leancloud.cn
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:43.0) Gecko/20100101 Firefox/43.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: text/plain; charset=UTF-8
Referer: http://localhost:4000/2016/06/22/%E5%BC%80%E7%AF%87/
Content-Length: 237
Origin: http://localhost:40003
Connection: keep-alive

响应头：
Access-Control-Allow-Origin: *
Cache-Control: max-age=120
Content-Length: 98
Content-Type: application/json;charset=utf-8
Date: Sat, 25 Jun 2016 03:15:49 GMT
Location: https://us-api.leancloud.cn/1.1/classes/Counter?redirectByAPI=cn
Server: nginx
Strict-Transport-Security: max-age=31536000
X-Firefox-Spdy: 3.1

跳转后
https://us-api.leancloud.cn/1.1/classes/Counter?redirectByAPI=cn
状态码：403
请求头：
Host: us-api.leancloud.cn
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:43.0) Gecko/20100101 Firefox/43.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Length: 237
Content-Type: text/plain
Referer: http://localhost:4000/2016/06/22/%E5%BC%80%E7%AF%87/
Origin: null
Connection: keep-alive

响应头：
Access-Control-Allow-Origin: *
Cache-Control: no-cache,no-store
Connection: keep-alive
Content-Length: 62
Content-Type: application/json;charset=utf-8
Date: Sat, 25 Jun 2016 03:15:50 GMT
Pragma: no-cache
Server: Tengine

响应：
{"code":403,"error":"Access denied by api domain white list."}

安全域名白名单里已经包含了 http://localhost:40003 为什么还会这样？
另外将安全域名清空，接口调用正常。
求破～！

将调用的 av-core-mini-0.6.1.js 改成 av-core-mini-0.6.4.js 后，不再 307了，403 的问题还是没有解决。