How do I limit access to API endpoints in Rails 4? - ajax

Question

I'm trying to figure out how to limit Cross-Domain access to a JSON API for 3 sites. It seems you have a few different things to deal with in Rails 4, such as:
protect_from_forgery with: :exception which prevents CSRF attacks.
Changing this to protect_from_forgery with: :null_session seems to allow the world to access it.
Trying this in application.rb:
config.action_dispatch.default_headers.merge!({
'Access-Control-Allow-Origin' => '*',
'Access-Control-Request-Method' => 'GET, POST, PUT'
})
This, again, allows the world to access your endpoints, however, it only allows a max of one site if you replace '*' with a URL. I'd like at least 3.
There are also gems you could use such as rack-cors:
In application.rb:
config.middleware.insert_before 0, "Rack::Cors" do
allow do
origins 'http://myFirstSite.com', 'http://mySecondSite.com', 'http://myThirdSite.com'
resource '/article_pages',
:headers => :any,
:methods => [:post],
:max_age => 0
resource '/article_pages',
:headers => :any,
:methods => [:put],
:max_age => 0
resource '*',
:headers => :any,
:methods => [:get],
:max_age => 0
end
end
This latest example is supposed to only allow the sites specified in origins, but seems to allow any site (as I've tested). I'm not sure if this is a configuration issue but it seems to be configured correctly via their docs.
There are also examples as such: https://gist.github.com/dhoelzgen/cd7126b8652229d32eb4
This one appears to allow ANY site to access the one endpoint inside the controller for which headers['Access-Control-Allow-Origin'] = '*' is set in a filter. Again, I'd like to limit the access to 3 sites.
What is a standard way of allowing only a few sites to access one public endpoint while blocking all other sites?