Add test for OPTIONS on token endpoint