Update cors.json

Added a bug and a resource, both referencing details IEInternals blog post.