add CORS warning to index