anchor.diff:          {<<"allow_credentials">>, AllowCredentials},
           {<<"allow_methods">>, AllowMethods},
           {<<"allow_headers">>, AllowHeaders},
  +        {<<"exposed_headers">>, ExposedHeaders},
           {<<"origins">>, {Origins}}
       ];
   get_cors_config(#httpd{cors_config = Config}) ->
  
positive.code:         true ->
              AcceptedOrigins = get_accepted_origins(Req, Config),
              CorsHeaders = handle_headers(Config, Origin, AcceptedOrigins),
              maybe_apply_headers(CorsHeaders, RequestHeaders);
          false ->
              RequestHeaders
      end.
  
  
  maybe_apply_headers([], RequestHeaders) ->
      RequestHeaders;
  maybe_apply_headers(CorsHeaders, RequestHeaders) ->
      %% Find all non ?SIMPLE_HEADERS and and non ?SIMPLE_CONTENT_TYPE_VALUES,
      %% expose those through Access-Control-Expose-Headers, allowing
      %% the client to access them in the browser. Also append in
  
negative.code:         AllowMethods0 ->
              split_list(AllowMethods0)
      end,
      ExposedHeaders = case config:get("cors", "exposed_headers", undefined) of
          undefined ->
              ?COUCH_HEADERS;
          ExposedHeaders0 ->
              split_list(ExposedHeaders0)
      end,
      Origins0 = binary_split_list(config:get("cors", "origins", [])),
      Origins = [{O, {[]}} || O <- Origins0],
      [
  