Add max-age header for cookies

Closes #1083