fix(cors): append access-control-max-age header to preflight response

fix(cors): append access-control-max-age header to preflight response #2335