Simple CORS request with exposed headers