Add access-control-max-age header to cors middleware for avoid options pre-flight

:icecream: 

This improves performance of ajax requests caching for some time all OPTIONS requests.