code: func forwardedCreds(c context.Context) (*oauth2.Token, error) {
  	switch s := GetState(c); {
  	case s == nil:
  		return nil, ErrNotConfigured
  	case s.User().Identity == identity.AnonymousIdentity:
  		return nil, nil // nothing to forward if the call is anonymous
  	default:
  		// Grab the end user credentials (or an error) from the auth state, as
  		// put there by Authenticate(...).
  		return s.UserCredentials()
  	}
  }
docs: // forwardedCreds returns the end user token, as it was received by the service.
  //
  // Returns (nil, nil) if the incoming call was anonymous. Returns an error if
  // the incoming call was authenticated by non-forwardable credentials.