code: func grabToken(src oauth2.TokenSource) (*oauth2.Token, error) {
  	switch tok, err := src.Token(); {
  	case isBadTokenError(err):
  		return nil, err
  	case isBadKeyError(err):
  		return nil, err
  	case err != nil:
  		// More often than not errors here are transient (network connectivity
  		// errors, HTTP 500 responses, etc). Retrying a fatal error a bunch of times
  		// is not very bad, so pick safer approach and assume any error is
  		// transient. Revoked refresh token or bad credentials (most common source
  		// of fatal errors) is already handled above.
  		return nil, transient.Tag.Apply(err)
  	default:
  		return tok, nil
  	}
  }
docs: // grabToken uses token source to create a new *oauth2.Token.
  //
  // It recognizes transient errors.