fix(cors): expose all headers set by application in access-control-expose-headers header value

fix(cors): expose all headers set by application in access-control-expose-headers header value #3672