added Access-Control-Expose-Headers at API call