CORS: safelist Content-Length header

Add a description of CORS: safelist Content-Length header