CORS headers have been added, but do not yet have tests. See `app/controllers/v1/api_controller.rb#set_cors_headers` for implementation.