Add Access-Control-Max-Age for CORS preflight headers

Currently, the browser needs to make two request for each Overpass API call in a CORS scenario: one for the OPTIONS preflight check and eventually the POST/GET. For interactive maps with several layers this creates a large number of additional requests.

This pull request adds an Access-Control-Max-Age HTTP response header with a timeout of 600 seconds (10 minutes), which allows the browser to cache the preflight options request and help improve performance for interactive maps.

Tested with firefox and chrome on local Overpass API installation.

[More details...](https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS)