Allow any origin during dev.
Actually define `notify`.
Use `postMessage` for cross-domain frame communication.
Change `/auth/logout` to POST.
Communicate to `window.opener`.
Don't send 403 so we actually clear session.
Allow credentials from anywhere
Spelled it wrong.
Try using Rack::Cors