Is your feature request related to a problem? Please describe.

When creating a JS script script for a bookmarklet, I noticed that I wasn't able to read rate-limit headers. I learned that it's because the browser requires the server to explicitly allow reading all but a standard set of headers for security:

• https://stackoverflow.com/a/58215085/11950764
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers

Describe the solution you'd like

In all places that Access-Control-Allow-Origin: * is added to responses, we should also add this header:

Access-Control-Expose-Headers: Ratelimit-Limit, Ratelimit-Policy, Ratelimit-Remaining, Ratelimit-Reset

to allow browser-based clients to read rate limit headers.

Describe alternatives you've considered

Wait for 429 response code, then exponential back-off. Or similar.