Fix CORS for additional_lookup urls.

Currently OPTIONS are not handled within the app
so there are no CORS related headers in the response.