add additional auth headers to cors "expose" list