set default CORS_PREFLIGHT_MAX_AGE to match docs