fix(cors): avoid overwriting Access-Control-Expose-Headers response header

fix(cors): avoid overwriting Access-Control-Expose-Headers response header #6708