exposed EXPOSE_HEADERS in cors.js to enable custom header in response request