Stop 500 error when adding CORS to 400 responses.
Disambiguate user routes.
Update documentation.
Merge API documentation into README.