Update README.md

Caveat about using "*" in CORS