need to use Access-Control-Expose-Headers on responses to all requests