Allow browsers access pagination data in headers (CORS)

[maxceem]

For the pagination functionality, we set headers X-Page, X-Per-Page, X-Total, X-Total-Pages, X-Prev-Page, X-Next-Page, so a client app can read them to show total number of the pages.

Due to security reasons, browsers do not allow access to custom headers unless explicitly set.
To let client-side code access pagination headers we have to set Access-Control-Expose-Headers header, see:

• Access-Control-Expose-Headers on MDN
• Issue description on StackOverflow

This is done via this PR.