Update OAuth20ProfileController.java

For the oauth2 /profile endpoint, if the access token is not in the request parameters, look for a bearer token in the authorization header. Allows the oauth2 support in CAS to be leveraged from spring-cloud/spring-cloud-security.
This is brittle. Why dont we check for exact values?