Added support for Access-Control-Expose-Headers in the response.
Tightented origin checking.  Origin is now checked on all requests.  If the origin does not match, no CORS headers will be returned.