Make OAuth token login endpoint CSRF exempt

@aleffert @nasthagiri 

@ormsbee I'd like to get this into the release if possible so we can unblock app testing