chore(cors): more explanation for flush in ServeHTTP