add note about CORS