[CORS] Must expose the Location header when creating new resources.