mentioned cors header in DEVELOP.rst