return 405 + according "Allow" header on token GET method

this follow the http standard more closely, still respecting oauth2 RFC.
Instead of returning a "400 Bad request", which is not really appropriate, it uses the http response code for "bad method" (here, "GET"), and adds in the answer a header specifiying the good one, as the http standard asks.