Update OAuth20ProfileController.java

For the oauth2 /profile endpoint, if the access token is not in the request parameters, look for a bearer token in the authorization header. Allows the oauth2 support in CAS to be leveraged from spring-cloud/spring-cloud-security.
Not sure I follow. You seem to be describing a use case related to spring-cloud/spring-cloud-security. Care to elaborate? Is this header something that is set by either of those two library? Do they have exact/specific names? Can we collect a list and retrieve them here? 

calling a substring of 7 characters on something that starts with "bearer" is very confusing at best in the log run. Before building any kind of support for this, we should make clear why this is needed.