Added support for Access-Control-Expose-Headers in the response.
Tightented origin checking.  Origin is now checked on all requests.  If the origin does not match, no CORS headers will be returned.
Fixed typo
Merge pull request #10 from sriddell/expose-headers

Added support for Access-Control-Expose-Headers in the response.
Version 1.1.0
Closes #8