Correct CORS_ORIGIN default in readme