Updates README to include note on xhr+cors

Signed-off-by: Christopher Rogers <chrissrogers@gmail.com>