Add note on cors and csp