Fix CORS max_age configuration parameter

Header "Access-Control-Max-Age" used by a browser to define
for how long to keep preflight request's response cached.

This fix makes this parameter configurable through config section
[cors], attribute max_age.