update readme about CORS config