CORS headers to /v0/oauth/token