expose timestamp header to clients that use CORS

This allows clients to see the header.