handle empty CORS expose-headers header response

The `access-control-expose-headers` should only be included in the response for non-empty lists according to http://www.w3.org/TR/cors/#resource-requests.

This patch fixes the response on servers configured with `{ cors: { exposedHeaders: [] } }`.