Use a single header for Access-Control-Expose-Headers

This fixes the case where more than one header is exposed.
Previously, only one header would be listed due to the way cowboy
handles multiple response headers with the same name.

If we had more control over the reply, we could perhaps add multiple
headers (due to how cowboy_req:reply/4 works).  However, this approach
is much simpler and appears to be more consistent with its use in the
wild.