typo fix; note about CORS