Support Access-Control-Expose-Headers in CORS

In this PR: 

* add a new method for CORSBuilder, AddExposedHeaders, like AddAllowedHeaders.   
* unconditionally add this header to responses, since it doesn't depend on any request headers.
* miscellaneous typo fixes and clarity rewording in comments
* completely gratuitous const grouping (which I can revert from this PR if you'd prefer; not sure what your coding standards are on that)