add note about django-cors-header joy