Added support for Access-Control-Expose-Headers in the response.
Tightened origin checking.