Convert Allow-Access-Control-Origin=* to the request domain, so we can allow the use of credentials
CORS support: also set Access-Control-Expose-Headers