return after error in permalink handler
upgrade the api for CORS/iframe requests, consistent with Ira's changes elsewhere