Update CORS documentation

The github repo is no longer canonical.

This is likely an artifact of earlier drupal versions where CORS wasn't set at all.

Keeping this as `false` disables CORS checking, which is fine in most cases. We would need different documentation for using CORS properly with domains.