Added clarifications to CORS section