Document http.cors-settings

These settings are not mentioned anywhere else.