Update OAuth20ProfileController.java

For the oauth2 /profile endpoint, if the access token is not in the request parameters, look for a bearer token in the authorization header. Allows the oauth2 support in CAS to be leveraged from spring-cloud/spring-cloud-security.
Unfortunately this part of the protocol isn't covered in spec and differs among providers. But this change makes the support a bit more flexible. I just committed a fix for the build failure.