Add permitAll() to OPTIONS requests on token endpoint to support CORS

Added permitAll() for OPTIONS requests back to the token endpoint to fix https://github.com/spring-projects/spring-security-oauth/issues/330 and https://github.com/spring-projects/spring-security-oauth/issues/184.