# config/initializers/cors.rb
# also tried moving this to config/application.rb and config.ru
Rails.application.config.middleware.insert_before 0, Rack::Cors do
  allow do
    origins 'https://example1.com', 'https://example2.com'
    resource '*',
             headers: :any,
             methods: [:get, :options, :head],
             expose: ['access-token', 'expiry', 'token-type', 'uid', 'client'],
             max_age: 0
  end
end