In order to get CORS requests working with AngularJS, I had to use sinatra/cross_origin and add some special code to handle HTTP OPTIONS requests:

options "*" do
  response.headers["Allow"] = "HEAD,GET,PUT,DELETE,OPTIONS"

  # Needed for AngularJS
  response.headers["Access-Control-Allow-Headers"] = "X-Requested-With, X-HTTP-Method-Override, Content-Type, Cache-Control, Accept"

  200
end

I'm not sure if this is an AngularJS specific issue or a problem in general, but it does appear that Firefox often sends an OPTIONS request before doing any kind of cross-origin request.