[readme] CORS config added