Escape HTML in the cors.rs documentation.

Rustdoc passes the code straight through, leading to poor generated HTML.