Requested Fixes

* Renable CORS
* Remove EnableResourceServer annotation because it prevents
  WebSecurityConfiguration from being used. Specifically it adds a
  HttpSecurity in ResourceServerConfiguration that matches on every request
  that is not an oauth request using NotOAuthRequestMatcher
* Add /hi->permitAll as was set in previous commit
* Use RequestMapping to map the prefix of the URLs The value of
  RestController is the bean name not a mapping