searching for an nonexistent id shouldn't result in a CORS error