Cross-domain access to /oauth2/access-token

/oauth2/access-token properly features a CSRF decorator, but is missing the required CORS headers in order to post to the URL cross-domain from Javascript.