add CORS headers to search method