Hi,
had the same issue when trying to run live-reload (pure emulate ios worked) but with -l flag it didn't.
From what I read, it is best to define 'per domain' exceptions.
Then I followed http://stackoverflow.com/questions/30731785/how-do-i-load-an-http-url-with-app-transport-security-enabled-in-ios-9/30732693#30732693 last entry from Aqib Mumtaz to whitelist just my local live domain.
Replace 'localhost.com' in the example with just 'localhost'
I hope it helps
davor