Add CORS Access-Control-Expose-Headers: Etag

Fixes #24.