Add permitAll() to OPTIONS requests on token endpoint to support CORS and restrict token endpoint to HTTP POST.

Added permitAll() for OPTIONS requests back to the token endpoint to fix https://github.com/spring-projects/spring-security-oauth/issues/330 and https://github.com/spring-projects/spring-security-oauth/issues/184.

Also, restricted token endpoint to only allow HTTP POST per https://github.com/spring-projects/spring-security-oauth/issues/327.
I've gone ahead and closed this PR since there is a better solution to the CORS problem than what is presented here. I've opened a separate PR to address the token endpoint POST issue.