Android's stock browser (and Webview) does not recognize the Access-Control-Expose-headers response header. Use the status text field to pass through this information. Updated demo and documentation.
xhr.getResponseHeader('Location') gives: > Refused to get unsafe header "Location"