Add permitAll() to OPTIONS requests on token endpoint to support CORS