Add Access-Control-Expose-Headers functionality to CORS