Well, now I'm even more embarrassed. I left some local variables in when I pushed the fix this morning and the site was blocked CORS for about an hour. This is why you don't push to prod when you're in a rush and half asleep. Thanks for letting me know.