Update the README, document CORs/data-urls