Add Access-Control-Expose-Headers to preflight response.

And fix nasty headers issue. Since the reply class is half singleton,
we need to make sure we initialize the headers only for the individual
reply, not for all replies.
Oops, put the CORS expose headers in the right place.