heroku feature I would KILL for: api to blacklist ips in heroku routing stack. Even rack is too late. I realize this is very non-trivial.
