looks like setting ExposeHeaders has no effect on requests to s3 (headers such as `x-amz-version-id` don't reach the clients) for browser-based uploads. 

http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPOST.html
object_key = 'key-by-hostname'
        self.s3_client.put_object(Bucket=bucket_name, Key=object_key, Body='something')
        url = self.s3_client.generate_presigned_url(
            'get_object', Params={'Bucket': bucket_name, 'Key': object_key}
        )
        self.s3_client.put_bucket_cors(Bucket=bucket_name,
            CORSConfiguration={
                'CORSRules': [{
                    'AllowedMethods': ['GET', 'PUT', 'POST'],
                    'AllowedOrigins': ['*'],
                    'ExposeHeaders': [
                        'Date', 'x-amz-delete-marker', 'x-amz-version-id'
                    ]
                }]
            },
        )
        
        url = self.s3_client.generate_presigned_url(
            'get_object', Params={'Bucket': bucket_name, 'Key': object_key}
        )
        response = requests.get(url, verify=False)
        self.assertTrue(response.headers['Date'])
        self.assertTrue(response.headers['x-amz-delete-marker'])
        self.assertTrue(response.headers['x-amz-version-id'])
        self.assertFalse(response.headers.get('x-amz-id-2'))
        self.assertFalse(response.headers.get('x-amz-request-id'))
        
        self.s3_client.delete_objects(Bucket=bucket_name, Delete={'Objects': [{'Key': object_key}]})
        self.s3_client.delete_bucket(Bucket=bucket_name)
    def test_s3_invalid_content_md5(self):