set Access-Control-Max-Age to 24h