fix(https): Expose X-Page and X-PageTotal headers when using CORS