fix(cors): set max age for cors headers

this will make client cache preflight requests