Adding cross origin policy headers to /hits endpoint.