anchor.diff:          true ->
               AcceptedOrigins = get_accepted_origins(Req, Config),
               CorsHeaders = handle_headers(Config, Origin, AcceptedOrigins),
  -            maybe_apply_headers(CorsHeaders, RequestHeaders);
  +            ExposedCouchHeaders = couch_util:get_value(
  +                <<"exposed_headers">>, Config, ?COUCH_HEADERS),
  +            maybe_apply_headers(CorsHeaders, RequestHeaders, ExposedCouchHeaders);
           false ->
               RequestHeaders
       end.
   
   
  -maybe_apply_headers([], RequestHeaders) ->
  +maybe_apply_headers([], RequestHeaders, _ExposedCouchHeaders) ->
       RequestHeaders;
  -maybe_apply_headers(CorsHeaders, RequestHeaders) ->
  +maybe_apply_headers(CorsHeaders, RequestHeaders, ExposedCouchHeaders) ->
       %% Find all non ?SIMPLE_HEADERS and and non ?SIMPLE_CONTENT_TYPE_VALUES,
       %% expose those through Access-Control-Expose-Headers, allowing
       %% the client to access them in the browser. Also append in
  
positive.code:         {<<"allow_credentials">>, AllowCredentials},
          {<<"allow_methods">>, AllowMethods},
          {<<"allow_headers">>, AllowHeaders},
          {<<"origins">>, {Origins}}
      ];
  get_cors_config(#httpd{cors_config = Config}) ->
  
negative.code:         true ->
              ExposedHeaders0
          end,
  
      %% ExposedCouchHeaders may get added later, so expose them by default
      ACEH = [{"Access-Control-Expose-Headers",
          string:join(ExposedHeaders ++ ExposedCouchHeaders, ", ")}],
      CorsHeaders ++ RequestHeaders ++ ACEH.
  
  
  