NewCrossOriginResourceSharingFilter should contain a "Access-Control-Expose-Headers" for "Location" by default or it should be possible to add it when calling the CORS command.

This is how I worked around it in the NewCrossOriginResourceSharingFilter.java filer :

response.getHeaders()
		.putSingle("Access-Control-Expose-Headers",
				"Location");