Add test to expose token endpoint vulnerability to non-POST
Enforce http method restrictions