Fix Access-Control-Max-Age functionality

The code was looking for the `maxAge` parameter instead of the `cors.maxAge` parameter