Pass an array to #in? instead of using two arguments
Add domains *.herokuapp.com to security headers for convenience
Arcane recipe