Expose X-Response-Time header by default about response-time

[dougwilson]

I agree, but it doesn't belong in this module. There are two problems with that code above in general:

1. It will stop over whatever someone has already set for 'Access-Control-Expose-Headers' which means it will cause a lot of headaches.
2. Unconditionally sending that header on every response is a violation of the CORS spec, so in order to get it right, all the cors logic would have to be built directly into this module.

I think it is reasonable that anyone who uses a cors module would realize they want to expose this header and configure their cors module to do so.

[mujz]

Great response! Thanks a lot for the explanation!