[cors] Add support for Access-Control-Expose-Headers