XHR should respect access-control-expose-headers header on redirect