Use a single header for Access-Control-Expose-Headers

Mainly necessary because cowboy will only respect multiple headers for
the response when calling cowboy_req:reply/3 or cowboy_req:reply/4.
This seems to be the simplest solution since we don't always have
control over when or how we reply.