Update notes for submitted changes

* Always set CORS headers at beginning of API handler.