expose Content-Range header in CORS requests