Update CORS implementation notes