Add Support for Access-Control-Expose-Headers

This header, as detailed in
http://www.w3.org/TR/cors/#access-control-expose-headers-response-header
allows a service to indicate which of its response headers should be
exposed to javascript handling the response. Without this, requests
which send down custom response headers will appear to receive headers
properly, but they will be stripped from the response when inspecting
the response headers of the XHR object.

This introduces new methods for adding and removing headers to the ACEH
header. Addition is accomplished using `ExposeHeader` and removal with
`RemoveExposedHeader`