CORS Access-Control-Expose-Headers, validator improved