Allow cross-domain access to /oauth2/access_token/