Add permitAll() to OPTIONS requests on token endpoint to support CORS and restrict token endpoint to HTTP POST.

Added permitAll() for OPTIONS requests back to the token endpoint to fix https://github.com/spring-projects/spring-security-oauth/issues/330 and https://github.com/spring-projects/spring-security-oauth/issues/184.

Also, restricted token endpoint to only allow HTTP POST per https://github.com/spring-projects/spring-security-oauth/issues/327.
I'm wondering what's the benefit of allowing the OPTIONS method on all resources ?