Add access-control-allow-origin header to internal search endpoint.