Add Header params to configure CORS for Rails 4 API

application_controller.rb

before_filter :allow_cors

def allow_cors
  headers["Access-Control-Allow-Origin"] = "*"
  headers["Access-Control-Allow-Methods"] = %w{GET POST PUT DELETE OPTIONS}.join(",")
  headers["Access-Control-Allow-Headers"] = %w{Origin Accept Content-Type X-Requested-With X-Prototype-Version X-CSRF-Token token}.join(",")
	headers['Access-Control-Max-Age'] = "1728000"
	if request.method == 'OPTIONS'
    render :text => '', :content_type => 'text/plain'
  end
end

routes.rb

# permit options method
match "path/to/action" => "controller#action", via: [ :post, :options]