Better CORS instructions