Add access-control-max-age header to cors middleware for avoid options pre-flight

:icecream: