Expose Location header when CORS is enabled