Add documentation on handling CORS pre-flights