New config setting for CORS Access-Control-Expose-Headers

Like the Access-Control-Allow-Headers directive allows the
the use of specific headers inside CORS requests, the
Access-Control-Expose-Headers directive allows access to
specific headers of the CORS response which are otherwise
inaccessible. A good example for this is the 'ETag' header
(that the client is interested in for sending it later inside
an 'If-Match' header).
This change makes the exposed headers configurable.