Add permitAll() to OPTIONS requests on token endpoint to support CORS and restrict token endpoint to HTTP POST.

Added permitAll() for OPTIONS requests back to the token endpoint to fix https://github.com/spring-projects/spring-security-oauth/issues/330 and https://github.com/spring-projects/spring-security-oauth/issues/184.

Also, restricted token endpoint to only allow HTTP POST per https://github.com/spring-projects/spring-security-oauth/issues/327.
The OAuth 2 token endpoint by default would prohibit HTTPS OPTIONS requests from completing successfully, resulting in the CORS preflight request getting blocked with a 401. This commit fixes this, but a better solution is to instead implement and register a Spring MVC CORS filter that will respond to all OPTIONS requests and return a 200 without going through Spring Security.