oidc userinfo endpoint blocking OPTIONS requests

[Cantor, Scott]

There are absolutely rules in web.xml but the up to date ones allow OPTIONS to every endpoint.

I would note there are other critical (in some cases) filter mappings that do enumerate endpoints that are not going to know about OIDC, and I'm not sure the docs note that. That will continue to be a manual change going forward I suspect unless we can come up with an overlay approach to address it.

-- Scott