Document why we need Access-Control-Allow-Origin (issue #2970)