Clear-up documentation around same origin policy, #56