David Kimura PRO said almost 3 years ago on Cross-Origin Resource Sharing (CORS) :
  It looks like in your staging, landing_page and production block, you allow all origins

origins "*"

Could you set an environment variable in place and things work properly?

origins ENV["URL_DOMAIN"]