Document same-origin issues for vanilla app