Add note regarding CORS