Add note to docs about CORS