Reflection on Access-Control-Expose-Headers

It would be nice to support reflection on `Access-Control-Expose-Headers` header. For example, following configuration allows access to any response header whose name starts with `X-Namespace-`.

```javascript
{
// ...
"exposedHeaders": /^X-Namespace-/i,
// ...
}
```

Supported types may include: boolean value, string, comma-separated string, RegExp., function predicate, and array of all of them, some of which are already supported in the case of `origin` or `allowedHeaders` option.