README: add section on the same-origin restriction