ENYO-3634: addind Allow-control-expose-headers header in CORS request

By default, a CORS enabled browser will ignore any header not considered "simple". As per the W3C documentation:
"User agents must filter out all response headers other than those that are a simple response header or of which the field name is an ASCII case-insensitive
match for one of the values of the Access-Control-Expose-Headers headers (if any), before exposing response headers to APIs defined in CORS API specifications."
The simple headers are "Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma".
We are setting the header x-content-type in some of Ares responses. If we do not *expose* it using the Allow-Control-Expose-Headers, the browser will never get this header.