title: CORS Access-Control-Max-Age is ignored
body: <p>I'm hosting an WebApp and his API on different domains and use CORS to be able to work around the same origin policy. So far, so good. This works.</p>
  
  <p>To only send a CORS preflight once per session I set the 
  Access-Control-Max-Age to 20 days, But this is not working (tested in Chrome):
  <a href="https://db.tt/vfIW3fD2">https://db.tt/vfIW3fD2</a></p>
  
  <p>What do I have to change?</p>