docs(README): Add note about CORS header