cors setup for http-only cookies

cors.rb

Rails.application.config.middleware.insert_before 0, Rack::Cors, debug: true do
  allow do
    origins 'http://client.your-domain-here.ngrok.io'
    resource '*',
      headers: :any,
      methods: [:get, :post, :put, :patch, :delete, :options, :head]
  end
end