Either my CORS misconfiguration is a heroku 0day, or people who write ruby almost universally suck at writing ruby.
