add local device cors setup in README