OAuth2 provider for Concur

Adding OAuth2 provider for Concur (see http://www.concur.com).
Unfortunately, Concur does not implement the exact OAuth2
specification. It differs in two main points:
* getAccessToken uses a HTTP GET request (instead of HTTP POST as
specified in http://tools.ietf.org/html/rfc6749#section-3.2)
* the access token response is delivered in XML (instead of JSON as
specified in http://tools.ietf.org/html/rfc6749#section-5.1)

For the documentation of Concur’s OAuth2 implementation please refer to
https://developer.concur.com/api-documentation/oauth-20-0/web-flow

In order to implement the bullets above I changed visibility of
`getAccessToken` to protected. This way it can be overridden in the
ConcurProvider.