Added CORS-requirement to specification