document CORS behaviour of box api, closes #51