CORS expose-headers does not need to contain Content-Type