Update README to mention enabling cors

Closes #1