add note about using 2.x.x with CORS