title: Why is Access-Control-Expose-Headers needed?
body: <p>I was looking for the specific security reasons as to why this was added. It was kind of a WTH moment when I was implementing cors and could see all the headers being returned but I couldn't access them via javascript..</p>