looks like setting ExposeHeaders has no effect on requests to s3 (headers such as `x-amz-version-id` don't reach the clients) for browser-based uploads. 

http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPOST.html
bucket_name = get_bucket_name(path, headers)
        
        hostname_parts = headers['host'].split('.')
        if (not bucket_name or len(bucket_name) == 0) and len(hostname_parts) > 1:
            bucket_name = hostname_parts[0]
        
        
        key = None
        if method == 'POST':
            key, redirect_url = multipart_content.find_multipart_redirect_url(data, headers)
            if key and redirect_url:
                response.status_code = 303
                response.headers['Location'] = expand_redirect_url(redirect_url, key, bucket_name)
                LOGGER.debug('S3 POST {} to {}'.format(response.status_code, response.headers['Location']))
        parsed = urlparse.urlparse(path)