Expose more headers on cors middleware