looks like setting ExposeHeaders has no effect on requests to s3 (headers such as `x-amz-version-id` don't reach the clients) for browser-based uploads. 

http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPOST.html
if origin in allowed or re.match(allowed.replace('*', '.*'), origin):
                    response.headers['Access-Control-Allow-Origin'] = origin
                    break
        
        exposed_headers = rule.get('ExposeHeader', [])
        for header in exposed_headers:
            if header.lower() == 'date':
                response.headers[header] = timestamp(format='%a, %d %b %Y %H:%M:%S +0000')
            elif header.lower() == 'etag':
                response.headers[header] = md5(response._content)
            elif header.lower() in ('server', 'x-amz-id-2', 'x-amz-request-id'):
                response.headers[header] = short_uid()
            elif header.lower() == 'x-amz-delete-marker':
                response.headers[header] = 'false'
            elif header.lower() == 'x-amz-version-id':
                
                response.headers[header] = 'null'
def get_lifecycle(bucket_name):
    response = Response()
    lifecycle = BUCKET_LIFECYCLE.get(bucket_name)
    if not lifecycle:
        
        lifecycle = {
            'LifecycleConfiguration': {}
        }
    body = xmltodict.unparse(lifecycle)
    response._content = body
    response.status_code = 200
    return response
def set_lifecycle(bucket_name, lifecycle):