browser: cors: check exposed response header for emptiness

getResponseHeader on firefox-3.5 and firefox-3.6 returns empty string instead of null