Unable to use websocket notifications from browsers

To subscribe to websocket notifications, we need to request the location by sending a get request to "http://<host>:<port>/restconf/streams/stream/<path>", which returns the location in the "Location" header.

However, this header is unsafe and is disabled in web browsers by default. To let browsers check this field, the web server must explicitly specify this header as exposed.

This can be enabled in the configuration of the CORS filter for sal-rest-connector. See attached diff.