Minor: reuse variable for brevity
Set Orbeon-Operations header on response
Use mysql-ng (provider) instead of crud-ng (path)
This way the search API will work; otherwise search wouldn't know it needs to call crud-ng instead of crud.
Use Set for operations as order is irrelevant
Check permissions on GET