Expose all headers for CORS requests.

This is a test application supposed to be used locally only. No reason
to limit exposed response headers, since we want clients to receive
the headers we add to responses.

Fixes #1023