Return Access-Control-Expose-Headers on GET, PUT and DELETE, not just OPTIONS.