update README to reflect CORS fixes