expose all individual-response headers for CORS calls