Add permitAll() to OPTIONS requests on token endpoint to support CORS and restrict token endpoint to HTTP POST.

Added permitAll() for OPTIONS requests back to the token endpoint to fix https://github.com/spring-projects/spring-security-oauth/issues/330 and https://github.com/spring-projects/spring-security-oauth/issues/184.

Also, restricted token endpoint to only allow HTTP POST per https://github.com/spring-projects/spring-security-oauth/issues/327.