Access-Control-Expose-Headers should be in regular responses, instead of preflight response

Access-Control-Expose-Headers should be in regular responses, instead of preflight response, as per http://www.html5rocks.com/en/tutorials/cors/ and http://www.w3.org/TR/cors/#access-control-expose-headers-response-header