Redirect with CORS header

Right now we're getting errors due to `/on/%elsewhere/%user_name/public.json` not passing a CORS header when redirecting