My suggestion is to avoid cookies completely since they'd be shared with all services on the same IP/hostname because they ignore ports. I'd also add a random "key" as the first thing in the URL path so you'd end up with something like "http ://127.0.0.1 :1234/Lxk8gE7qnClf/actual/path/here" and have everything else tell the user to open the app with your icon or something.

This prevents malware from accessing your app while avoiding leaking authentication cookies to other http services on localhost.

Is there any reason you can’t bind a DNS name to localhost?

Security wise, that is.

You could use entire 127/8 but using such instead of 127.0.0.1 for security reasons (so that people don't guess or connect to a port) makes no sense.

Filtering by the referrer should be a good start.

It at least used to be the case that this could be gotten around with flash, though that may be fixed, and many people won't run strange flash anymore anyway.

Another way, if you're using WebSockets, you can establish that the latency is unrealistically low to be a switched physical network, with pings (with cookies).