Add `max_age/1` callback for cross-origin policies

This allows the `Access-Control-Max-Age` header to be set in the
response to a preflight request.  The return value of this callback
must be a positive integer or 'undefined'.