Expose Content-Range response header for CORS requests on upload

When a client submits an HTTP request with 'Range' header, the actual
range returned, including the total file size, comes back in the
'Content-Range' response header.

Naturally, this doesn't get automatically exposed in cross-origin requests
and must be explicitly listed in the OPTIONS response. Yay CORS!

Exposing this will let ogv.js eliminate an extra HEAD request to get
the total file size, and allows validation of the ranges to check for
a Safari caching bug <https://bugs.webkit.org/show_bug.cgi?id=82672>
without adding a cachebuster query string on every request.

Change-Id: I35d51c66814fd23972c8044208b1545b8e20f464