change API - rename "corsHeaders" option to "corsExposedHeaders"