Update OAuth20ProfileController.java

if the access token is not in the request parameters, look for a bearer token in the authorization header