Send proper CORS Access-Control-Expose-Headers header, and test for token with user and expiry