Expose Link header with Access-Control-Expose-Headers

Currently JavaScript clients are not allowed to read the `Link` header (reported by Benedikt Klus).