set Access-Control-Expose-Headers
make GET and HEAD requests return 403 instead of 412, when If-None-Match is present and the conditions fails (refs #1)