Allowing long polling and Projection debug 4 CORS

To be able to do long polling from different domain or HTML file `Access-Control-Allow-Headers` needs to contain `ES-LongPoll`.

To read position in Projection debugging, `Access-Control-Expose-Headers` needs to contain `ES-Position`