KEYCLOAK-385 Add CORS support to refresh token