Added support for Access-Control-Expose-Headers in the response.
Tightented origin checking.  Origin is now checked on all requests.  If the origin does not match, no CORS headers will be returned.
Merge pull request #10 from sriddell/expose-headers

Added support for Access-Control-Expose-Headers in the response.