Fix CORS support for oauth/token, refs D396