seconds and util for CORS with max-age for cache-control