Improve documentation about CORS headers

[bvibber]

I've had several inquiries related to CORS headers over the months and I think it's because the docs are not clear. :) I should improve this.