Typo in 'exposed headers' header name.

According to [the spec](http://www.w3.org/TR/cors/#access-control-expose-headers-response-header) this should be 'Access-Control-Expose-Headers', ran into trouble with this when using AngularJS :)