add CORS headers to search requests

also various cleanups