Updated API docs to mention CORS