code: func TokenExpiresInRnd(ctx context.Context, t *Token, lifetime time.Duration) bool {
  	if t == nil || t.AccessToken == "" {
  		return true
  	}
  	if t.Expiry.IsZero() {
  		return false
  	}
  	expiry := t.Expiry.Round(0) // force to use wall clock time
  	deadline := clock.Now(ctx).Add(lifetime)
  	if expiry.Before(deadline) {
  		// Definitely expires within 'lifetime'.
  		return true
  	}
  	if expiry.After(deadline.Add(expiryRandInterval)) {
  		// Definitely expires much later than 'lifetime', no need to involve RNG.
  		return false
  	}
  	// Semi-randomly declare it as expired.
  	rnd := time.Duration(mathrand.Int63n(ctx, int64(expiryRandInterval)))
  	return expiry.Before(deadline.Add(rnd))
  }
docs: // TokenExpiresInRnd is like TokenExpiresIn, except it slightly randomizes the
  // token expiration time.
  //
  // If the function returns False, the token expires past now+lifetime. In other
  // words, it is totally safe to use the token until now+lifetime. The inverse of
  // this statement is not correct though: if the function returns True, it
  // doesn't necessarily imply the token will expire before now+lifetime.
  //
  // The function returns True in any of the following conditions:
  //  * The token is not valid.
  //  * The token expires before now+lifetime.
  //  * The token expiration time is between (now+lifetime, now+lifetime+rnd),
  //    where rnd is a uniformly distributed random number between 0 and
  //    expiryRandInterval sec (which is set to 30 sec).
  //
  // This is useful for processes that use multiple service account keys at
  // around the same time. Without randomization, access tokens for such keys
  // expire at the same time (strictly 1h after process startup, where 1h is
  // the default token lifetime). This causes unnecessary contention on the token
  // cache file.