Add note about including CORS headers in htaccess