looks like setting ExposeHeaders has no effect on requests to s3 (headers such as `x-amz-version-id` don't reach the clients) for browser-based uploads. 

http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPOST.html
response = Response()
    exists, code = bucket_exists(bucket_name)
    if not exists:
        response.status_code = code
        return response
    cors = BUCKET_CORS.get(bucket_name)
    if not cors:
        cors = {
            'CORSConfiguration': []
        }
    body = xmltodict.unparse(cors)
    response._content = body
    response.status_code = 200
    return response
def set_cors(bucket_name, cors):
    response = Response()
    exists, code = bucket_exists(bucket_name)
    if not exists:
        response.status_code = code
        return response
    if not isinstance(cors, dict):
        cors = xmltodict.parse(cors)
    BUCKET_CORS[bucket_name] = cors
    response.status_code = 200
    return response
def delete_cors(bucket_name):