Moving from dev (local) to staging server, access control issues abound

I am getting numerous errors loading the /signup page of the form:
[blocked] The page at https://mydomain.com/signup was not allowed to display insecure content from http://localhost:3001/auth/me

Then when I go to sign up, further errors of the form:
Not allowed to request resource
XMLHttpRequest cannot load http://loclhost:3001/auth/me due to access control checks

I cannot find any references in the app code to localhost or /auth/me so I assume this is coming from the wasp framework.

I've configured an extremely permissive cors middleware:

-----
import cors from 'cors';

export const corsMiddleware = cors({
origin: true, // Allow any origin
credentials: true,
});
-----
I note that there is only one endpoint in the main.wasp that specifies a middlewareConfigFn, and that is our Stripe webhook.

What could be the issue @kapa.ai