Issue #3347513: access-control-max-age will be 0 if you use Drupal's default CORS config in D10