Fix CORs
Update readme for note on CORS