Support Access-Control-Expose-Headers in CORS

In this PR: 

* add a new method for CORSBuilder, AddExposedHeaders, like AddAllowedHeaders.   
* unconditionally add this header to responses, since it doesn't depend on any request headers.
* miscellaneous typo fixes and clarity rewording in comments
* completely gratuitous const grouping (which I can revert from this PR if you'd prefer; not sure what your coding standards are on that)

This typo fix made me realize there may be another bug :flushed: Do we handle `Access-Control-Request-Method` at all? We have a constant for it, but it's not used anywhere..