docs(*) mention 0.10.1 CORS regression

* mentioned in 0.10.1 changelog
* mentioned in the 0.10.x upgrade path

From Kong#2517

CHANGELOG.md

@@ -165,8 +165,15 @@
   defaulted to `127.0.0.1` in Kong 0.10.0. Greater versions of Serf can still
   be used, but the IP address needs to be manually specified in the
   `cluster_advertise` configuration property.
-- :warning: [CORS Plugin](https://getkong.org/plugins/cors/) parameter
-`config.origin` is now `config.origins`.
+- :warning: The [CORS Plugin](https://getkong.org/plugins/cors/) parameter
+  `config.origin` is now `config.origins`.
+
+   :red_circle: **Post-release note (as of 2017/05/12)**: A faulty behavior
+   has been observed with this change. Previously, the plugin would send the
+   `*` wildcard when `config.origin` was not specified. With this change, the
+   plugin **does not** send the `*` wildcard by default anymore. You will need
+   to specify it manually when configuring the plugin, with `config.origins=*`.
+   This behavior is to be fixed in a future release.
   [#2203](https://github.com/Mashape/kong/pull/2203)
 - Admin API:
   - Disable support for TLS/1.0.

UPGRADE.md

@@ -66,6 +66,13 @@ Kong 0.10 introduced the following breaking changes:
 - The `cassandra_contact_points` property does not allow specifying a port
   anymore. All Cassandra nodes must listen on the same port, which can be
   tweaked via the `cassandra_port` property.
+- If you are upgrading to `0.10.1` or `0.10.2` and using the CORS plugin, pay
+  extra attention to a regression that was introduced in `0.10.1`:
+  Previously, the plugin would send the `*` wildcard when `config.origin` was
+  not specified. With this change, the plugin **does not** send the `*`
+  wildcard by default anymore. You will need to specify it manually when
+  configuring the plugin, with `config.origins=*`. This behavior is to be fixed
+  in a future release.
 
 We recommend that you consult the full [0.10.0
 Changelog](https://github.com/Mashape/kong/blob/master/CHANGELOG.md) for a full