CorsConfig exposeHeaders and validRequestHeaders should take String varags

Currently these two methods take a single comma separated String. It would be much better to have them take a variable number of string arguments instead.