README.md: rework against the fourth review

CORS: the built page needs no entry. DEBUG: every value is accepted.
Model: fable-5-1

README.md

@@ -353,7 +353,7 @@ names the variable. An empty variable counts as unset, except `TRUSTED_PROXIES`.
 - `SENTRY_DSN`, default empty: the DSN of a Sentry project to report crashes to.
   See [Sentry](#sentry).
 - `DEBUG`, default empty: any non-empty value turns debug logging on, `false`
-  and `0` included. No value of it stops the start.
+  and `0` included. Every value is accepted.
 
 ### Trusted proxies
 
@@ -464,10 +464,11 @@ every report stored before them is deleted to make room. A lower
 ### CORS
 
 The page calls the API from the origin it is served from. By default the server
-sends no CORS headers, so browsers let no other origin's pages call it. To serve
+sends no CORS headers, so browsers let no other origin's pages call it.
-the page from elsewhere, list that origin in `CORS_ALLOWED_ORIGINS`, for example
+`CORS_ALLOWED_ORIGINS` lets pages served from the listed origins call the API,
-`https://netwatch.example.com`. Pages from a listed origin may `GET` and `POST`
+for example `https://netwatch.example.com`. The page as built posts to its own
-with a `Content-Type` header.
+origin only, so it needs no entry. Pages from a listed origin may `GET` and
+`POST` with a `Content-Type` header.
 
 Each entry must be a plain origin as browsers send it: `scheme://host`, with an
 optional `:port`, no path, no trailing `/` and no `*`. Any other entry stops the