Hide this back (for now)
Set CORS on just the search endpoint