return an empty links array instead of 404
add access-control-allow-origin header

for #8