ensure AJAX requests returns the location as expected
let Access-Control-Expose-Headers to be specified as expected for CORS requests