add CORS to README.md