add allowed methods and exposed headers to apache CORS filter