Clarify requirements on a CORS server

Fixes whatwg#172.

fetch.bs

@@ -1952,6 +1952,13 @@ if the <a>CORS protocol</a> is understood. It uses `<code>OPTIONS</code>` as
  of the response by listing their <a lt=name for=header>names</a>.
 </dl>
 
+<hr>
+
+<p>In case a server does not wish to participate in the <a>CORS protocol</a>, its HTTP response to
+the <a lt="CORS request">CORS</a> or <a>CORS-preflight request</a> must not include any of the above
+<a>headers</a>. The server is encouraged to use the <code>403</code> <a for=/>status</a> in such
+HTTP responses.
+
 
 <h4 id=http-new-header-syntax>HTTP new-header syntax</h4>