Add Access-Control headers to asset requests in Rails to cross-domain assets work with CORS