Add guard o project
Expose response headers

The CORS requires us expose these to allows access to the headers in browser.