Response code for un-authenticated access to /oauth/token endpoint

A change in 1.4.3 added bearer token access to the token endpoint, but the
request matchers were overspecified so access without an Authorization
header was dropping through to the default login entry point (instead of
the OAuth one).

[Fixes #57751368] [cfid-805]