Update readme for note on CORS