Added a comment explaining why the CORS-related headers are there.