made introspection and revocation work with basic auth (and possible OAuth tokens, but that needs more work)
added CORS filter