Which response headers JavaScript may read beyond the safelisted ones.
final Set<String> exposeHeaders;