title: Spring Security OAuth2 check_token endpoint
body: <p>I'm trying to setup a resource server to work with separate authorization server using spring security oauth. I'm using <code>RemoteTokenServices</code> which requires <code>/check_token</code> endpoint.  </p>
  
  <p>I could see that <code>/oauth/check_token</code> endpoint is enabled by default when <code>@EnableAuthorizationServer</code> is used. However the endpoint is not accessible by default. </p>
  
  <p>Should the following entry be added manually to whitelist this endpoint?</p>
  
  <pre><code>http.authorizeRequests().antMatchers("/oauth/check_token").permitAll();
  </code></pre>
  
  <p>This will make this endpoint accessible to all, is this the desired behavior? Or am I missing something. </p>
  
  <p>Thanks in advance, </p>