add note about cors, closes #28