Allow origin * on read api errors

Set Access-Control-Allow-Origin header to * when the read API errors.
This is to allow easier debugging in spotlight.

This was originally going to be done in Nginx, however, on investigation
it was discovered that we'd need a non-standard module to add headers to
the response. This was a simpler route.