Update notes for submitted changes

* Allow all headers requested for CORS.