Like wise this issue (https://tracker.moodle.org/browse/MDL-47545), it would be good also to allow token.php page to be called through AJAX in a cross domain mode.
To do so, just add header('Access-Control-Allow-Origin: *'); at the beginning of the script.