Add note about CORS