update readme for enable CORS