Oh, it's .herokuapp.com, not .heroku.com. The 301 redirect was losing our POSTdata.