added "OPTIONS" option to /token filter with no auth, addresses #527