Title: CORS filter sets the access-control-expose-headers header even when the origin is not allowed

It appears that this issue stems from #33051.

The is_cors_request_ variable is now being set to true when origin_allowed is false.

Previously, in the code prior to this PR, is_cors_request_ was set to false when origin_allowed was false.

Is this behavior expected, or is it a bug?