Add permitAll() to OPTIONS on token endpoint

Fixes gh-184