Fix CORS for additional_lookup urls.

Currently OPTIONS are not handled for additional_lookups within the app so there are no CORS related headers in the response.