added note about CORS