update read me for CORS setup