add readme for cors explanation