Add CORS to OAuth access token route
Add a new type for OAuth requests called token that checks allowed redirect URIs before sending back a token, useful for client-side requests where you dont want to share a secret key.