set which headers should be exposed on CORS