test(cors): pin Access-Control-Max-Age 3600 on preflight

Refs #47

src/test/java/auth_service/configuration/security/SessionFlowTest.java

@@ -298,7 +298,8 @@ class SessionFlowTest extends AbstractIntegrationTest {
                         .header("Access-Control-Request-Headers", "x-tbp-client"))
                 .andExpect(status().isOk())
                 .andExpect(header().string("Access-Control-Allow-Origin", FRONTEND))
-                .andExpect(header().string("Access-Control-Allow-Credentials", "true"));
+                .andExpect(header().string("Access-Control-Allow-Credentials", "true"))
+                .andExpect(header().string("Access-Control-Max-Age", "3600"));
 
         mockMvc.perform(options("/api/auth/refresh")
                         .header("Origin", "https://evil.andreas-dahm.eu")