CORS requests are now allowed via the Rack::Cors gem, instead of our own
before_action.