False withCredentials for wildcard CORS
Search now takes params object as first arg. Fix #1