What exactly is the HttpInterceptor in Angular?
localhost:4200 should be what you add to "allowedUrls". This tells the auth server that requests from your angular app are "allowed".