Add a note about Access-Control-Allow-Origin policy for front-end CSV request