[cors] Fix CORS headers generators
The Access-Control-Allow-* and Access-Control-Expose-Headers are response
headers, not request headers.
Hence, we need generators for them. Closes #4412575.
\.svn
^build$
^dist$
\.pyc$
\.pyo$
\.bak$
\.old$
\~$
\#.*?\#$
\.swp$
^doc/book/en/apidoc$
\.old$
syntax: regexp
.*/data/database/.*\.sqlite
.*/data/database/.*\.config
.*/data/database/tmpdb.*
.*/data/ldapdb/.*
^doc/html/
^doc/doctrees/
^doc/book/en/devweb/js_api/
data/pgdb/