WebAuthBase: In /oauth2/token response, accept "Bearer" or "bearer".

The correct value is "Bearer", but the server currently sends back
"bearer".