Set CORS headers in production.
Iterate on ActiveAdmin.