TL;DR: A javascript client cannont read our X-PAGINATION-* headers if it is not on the same domain of the requested Tuleap server.

On non-CORS requests, all headers are available through XMLHttpRequest. However, when doing a CORS request, by default only simple response headers are readable with XMLHttpRequest (Content-Type, Last-modified, Content-Language, Cache-Control, Expires, Pragma).

As X-PAGINATION-SIZE is obviously not part of the simple response headers list, we need to enable it by using the Access-Control-Expose-Headers:

Access-Control-Expose-Headers: X-PAGINATION-SIZE

This blocks people to build tools based on Tuleap REST API.

References: 
http://www.w3.org/TR/cors/#terminology 

http://www.w3.org/TR/cors/#access-control-expose-headers-response-header 

https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Access-Control-Expose-Headers