Note about middleware order and ETags

It's not obvious but if middleware is not in this order it leads to errors in Chrome when trying to do cross-domain XHR with ETags.

See here for info http://stackoverflow.com/questions/11933626/access-control-allow-origin-header-not-working-what-am-i-doing-wrong

Basically the 304 response must have the CORS headers, but `CommonMiddleware` replaces the existing response with a new `HttpResponseNotModified` so they get lost unless `CorsMiddleware` processes the request later.