add cors description to express.md