[cors] Fix CORS headers generators
The Access-Control-Allow-* and Access-Control-Expose-Headers are response
headers, not request headers.
Hence, we need generators for them. Closes #4412575.
[wsgi] Fix posted files filename reading
The filenames are parsed by multipart.parse_form_data, which does the unicode
decoding. Trying to re-decode the filename was leading to an error.