<system.webServer>
    <httpProtocol>
        <customHeaders>
            <clear />
            <add name="Access-Control-Allow-Origin" value="http://localhost:63180" />
            <add name="Access-Control-Allow-Headers" value="Content-Type"/>
        </customHeaders>
    </httpProtocol>
    .
    .
    .

public class ApplicationOAuthProvider : OAuthAuthorizationServerProvider
{
.
.
.
    public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
{
.
.
.
context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin",
        new[] { "http://localhost:63180" });
.
.
.
}

(function () {
"use strict";
angular.module("common.services")
    .factory("accountResource",
    ["$resource", accountResource]);

function accountResource($resource) {
    return {
        registration: $resource("http://localhost:57939/api/Account/Register", null,
            {
                'registerUser': { metod: 'POST' }
            }),
        login: $resource("http://localhost:57939/Token", null,
            {
                'loginUser': {
                    metod: 'POST',
                    headers: {
                        'Content-Type': 'application/x-www-form-urlencoded'
                    },
                    withCredentials: false,
                    transformRequest: function (data, headersGetter) {
                        var strArr = [];
                        for (var item in data) {
                            strArr.push(encodeURIComponent(item) + "=" +
                                encodeURIComponent(data[item]));
                        }
                        return strArr.join("&");
                    }
                }
            })
    }
}

}());

GET /Token?grant_type=password&password=a&userName=a HTTP/1.1
Host: localhost:57939
Connection: keep-alive
Accept: application/json, text/plain, */*
Origin: http://localhost:63180
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.89 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost:63180/
Accept-Encoding: gzip, deflate, sdch
Accept-Language: he-IL,he;q=0.8,en-US;q=0.6,en;q=0.4

grant_type:password
password:a
userName:a