Documenting a caveat on when one can use applyCORS