Access-Control-Expose-Headers should be in regular responses, instead of preflight response