Switched to CORS, changed from assuming lookup server was sending 404s to assuming it was sending empty lists and objects when it didn't find things.