Added expose-headers default to allowCORS, hasNext param to
forEachOwnProperty, string.decapitalize,