CORS issue: Getting error "No 'Access-Control-Allow-Origin' header is present" when it actually is

I doubt the backend serving my app is important, but if you care, I'm using rack-cors with a Rails 4.0 app.

Using jQuery, I send my app a PATCH request like so:

$.ajax({
  url: "http://example.com/whatever",
  type: "PATCH",
  data: { something: "something else" }
})

When I trigger this call from Chrome, I see a successful OPTIONS request go out, which returns these headers from my server:

Access-Control-Allow-Credentials:true
Access-Control-Allow-Headers:accept, content-type
Access-Control-Allow-Methods:GET, PUT, PATCH, OPTIONS
Access-Control-Allow-Origin: http://sending-app.localhost:3000
Access-Control-Expose-Headers:
Access-Control-Max-Age:15

Then I see a PATCH request go out, which throws this error:

XMLHttpRequest cannot load http://example.com/whatever. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://sending-app.localhost:3000' is therefore not allowed access.

I have tried switching from PATCH to PUT with the same results.

This doesn't make any sense to me. What's going on?

Update: My config/application.rb

I thought the headers told the whole story, but since people are confused, here's my config/application.rb file, which is how the rack-cors plugin for Rails is configured:

config.middleware.use Rack::Cors do
  allow do
    origins '*'
    resource '*',
      :headers => :any,
      :methods => [:get, :put, :patch, :options],
      :max_age => 15
  end
end