I figured it out! It was still a CORS issue. Online console was slow and enforces CORS, localkit and the iOS debugger did not. I was able to verify the issue by save a static JSON response into a file and put it on a web server.
On top of that, the web based debugger leaked the response JSON data even as it was supposed to block access,