looks like setting ExposeHeaders has no effect on requests to s3 (headers such as `x-amz-version-id` don't reach the clients) for browser-based uploads. 

http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPOST.html
acl = acl or 'private'
        multipart_upload_dict = self.s3_client.create_multipart_upload(Bucket=bucket, Key=key, ACL=acl)
        uploadId = multipart_upload_dict['UploadId']
        
        data = data or (5 * short_uid())
        data = to_bytes(data)
        upload_file_object = BytesIO(data)
        if zip:
            upload_file_object = BytesIO()
            with gzip.GzipFile(fileobj=upload_file_object, mode='w') as filestream:
                filestream.write(data)
        response = self.s3_client.upload_part(Bucket=bucket, Key=key,
            Body=upload_file_object, PartNumber=1, UploadId=uploadId)
        multipart_upload_parts = [{'ETag': response['ETag'], 'PartNumber': 1}]
        return self.s3_client.complete_multipart_upload(Bucket=bucket,
            Key=key, MultipartUpload={'Parts': multipart_upload_parts}, UploadId=uploadId)