X_DEV_HOST_REFUSED
Means
a /_x request named a host that is not this machine
Typical cause
the request reached x dev with a Host header that is not localhost, a *.localhost name or a loopback address, which is how a DNS-rebinding page reads the dev dashboard and its database cross-origin
Fix
curl -sS -H 'accept: application/json' http://localhost:3000/_x