COUCHDB-1922: fix CORS exposed headers