component file sharing: added `Access-Control-Expose-Headers` CORS header: without this header, the range header in response was not exposed to client. This could cause trouble is a javascript application was needing to access it.