Ensure API is requested from same domain as Rails app