Rails / rack-cors: blacklisted traffic reaches rails application

Question

I am using rack-cors to restrict all URLs but one. However, traffic is somehow reaching the rails application from \'blacklisted\' urls. For example I want the app