Allow CORS in /api/search