diff --git a/Gemfile b/Gemfile
index 39bf724..cdd2be7 100644
--- a/Gemfile
+++ b/Gemfile
@@ -21,8 +21,6 @@ gem "aws-sdk-s3", "~> 1.160"
 gem "content_disposition", "~> 1.0"
 gem "uppy-s3_multipart", "~> 1.2"
 
-# CORS
-gem 'rack-cors'
 
 #####################################
 # Try to work around brokenness on
diff --git a/config/application.rb b/config/application.rb
index 82f5a2b..5c5a46b 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -23,6 +23,10 @@
 module Dromedary
   class Application < Rails::Application
 
+    # CORS with rails running not-at-the-root turns out to be mostly broken.
+    # So we do this, which stinks.
+    config.action_controller.forgery_protection_origin_check = false
+
     config.time_zone = 'Eastern Time (US & Canada)'
 
     # Initialize configuration defaults for originally generated Rails version.