Support for Access-Control-Expose-Headers in the CORS options

[MathieuLoutre]

Added options to CORS to include custom Access-Control-Expose-Headers. It's using the same mechanisms as headers and methods options (a main one with default, in this case to 'WWW-Authenticate, Server-Authorization', and an additional one to add instead of override).

These headers are necessary when making a CORS request to force the getReponseHeader() method of the XmlHttpRequest2 object:

"Access-Control-Expose-Headers (optional) - The XmlHttpRequest2 object has a getResponseHeader() method that returns the value of a particular response header. During a CORS request, the getResponseHeader() method can only access simple response headers. Simple response headers are defined as follows:

• Cache-Control
• Content-Language
• Content-Type
• Expires
• Last-Modified
• Pragma

If you want clients to be able to access other headers, you have to use the Access-Control-Expose-Headers header. The value of this header is a comma-delimited list of response headers you want to expose to the client." (http://www.html5rocks.com/en/tutorials/cors/#toc-handling-a-simple-request)

The real testing of this feature is hard because it depends on an implementation of XmlHttpRequest2 to make sure that the headers which are specified are truly exposed because this "blindness" is only due to XmlHttpRequest2. Still, I added a test for existence of the default exposed headers where I found the test for existence of the default headers.

The choice of the default exposed headers was made to match what's needed by Hawk.

[hueniverse]

Sweet! Can you add a link to the specification where this header is defined? Also if you are up to it, add a Browser Considerations section to the Hawk readme to highlight this.

[MathieuLoutre]

The specification is very short and can be found here: http://www.w3.org/TR/cors/#access-control-expose-headers-response-header
Should I add it to the docs, in the CORS options section?

As for Hawk, I'm on it!

[hueniverse]

No need to add to the docs. Just wanted the reference and a "paper" trail in the issue comments.