Document http.cors-settings