code: func providerAuthHeaderWorks(tokenURL string) bool {
  	for _, s := range brokenAuthHeaderProviders {
  		if strings.HasPrefix(tokenURL, s) {
  			// Some sites fail to implement the OAuth2 spec fully.
  			return false
  		}
  	}
  
  	// Assume the provider implements the spec properly
  	// otherwise. We can add more exceptions as they're
  	// discovered. We will _not_ be adding configurable hooks
  	// to this package to let users select server bugs.
  	return true
  }
docs: // providerAuthHeaderWorks reports whether the OAuth2 server identified by the tokenURL
  // implements the OAuth2 spec correctly
  // See https://code.google.com/p/goauth2/issues/detail?id=31 for background.
  // In summary:
  // - Reddit only accepts client secret in the Authorization header
  // - Dropbox accepts either it in URL param or Auth header, but not both.
  // - Google only accepts URL param (not spec compliant?), not Auth header
  // - Stripe only accepts client secret in Auth header with Bearer method, not Basic