updated CORS section

updated to reflect that OAuth endpoints do not support CORS