[bug 1088807] Fix User API filtering stuff.
[bug 1089929] Don't error if client doesn't provide CORS headers.