Support Access-Control-Expose-Headers in CORS

In this PR: 

* add a new method for CORSBuilder, AddExposedHeaders, like AddAllowedHeaders.   
* unconditionally add this header to responses, since it doesn't depend on any request headers.
* miscellaneous typo fixes and clarity rewording in comments
* completely gratuitous const grouping (which I can revert from this PR if you'd prefer; not sure what your coding standards are on that)

It's used in method_not_allowed.go, which made things somewhat difficult to understand when I first looked at it.

However, I didn't worry to much about it because there's an issue to rewrite this stuff anyway, #49 .