issue #756: set access-control-expose-headers on CORS response

the following HTTP headers are now whitelisted by ArangoDB in CORS responses:
- etag
- content-encoding
- content-length
- location
- x-arango-errors
- x-arango-async-id