--- a/cubicweb/pyramid/__init__.py	Tue Apr 04 10:50:49 2017 +0200
+++ b/cubicweb/pyramid/__init__.py	Thu Jun 22 16:39:48 2017 +0200
@@ -111,7 +111,9 @@
         app,
         origin=' '.join(cwconfig['access-control-allow-origin']),
         headers=', '.join(cwconfig['access-control-allow-headers']),
+        expose_headers=', '.join(cwconfig['access-control-expose-headers']),
         methods=', '.join(cwconfig['access-control-allow-methods']),
+        maxage=cwconfig['access-control-max-age'],
         credentials='true')
 
     if profile: