Add `max_age/2` callback for cross-origin policies

This allows the `Access-Control-Max-Age` header to be set in the
response to a preflight request.  The return value of this callback
must be a non-negative integer or 'undefined'.