CORS: irrelevant headers are indiscriminately set in the preflight/actual responses

[jub0bs]

The CORS middleware sets each ((if its value is non-empty) of the following headers in both preflight responses and actual responses:

Access-Control-Allow-Origin
Access-Control-Allow-Headers
Access-Control-Allow-Methods
Access-Control-Allow-Credentials
Access-Control-Expose-Headers
Access-Control-Max-Age

However, the only relevant headers for preflight responses are the following:

Access-Control-Allow-Origin
Access-Control-Allow-Headers
Access-Control-Allow-Methods
Access-Control-Allow-Credentials
Access-Control-Max-Age

And the only relevant headers for actual responses are the following:

Access-Control-Allow-Origin
Access-Control-Allow-Credentials
Access-Control-Expose-Headers

Middleware should avoid setting irrelevant headers because doing so has a cost, both in terms of transport and in terms of heap allocations on the server.