code: func (a *Authenticator) currentToken() (tok *internal.Token, err error) {
  	a.lock.RLock()
  	initialized, err := a.checkInitialized()
  	if initialized && err == nil {
  		tok = a.authToken.token
  	}
  	a.lock.RUnlock()
  	if err != nil {
  		return
  	}
  
  	if !initialized || tok == nil {
  		a.lock.Lock()
  		defer a.lock.Unlock()
  
  		if !initialized {
  			if err = a.ensureInitialized(); err != nil {
  				return
  			}
  			tok = a.authToken.token
  		}
  
  		if tok == nil {
  			// Reading the token from cache is best effort. A broken cache is treated
  			// like a cache miss.
  			if cacheErr := a.authToken.fetchFromCache(a.ctx); cacheErr != nil {
  				logging.Warningf(a.ctx, "Failed to read auth token from cache: %s", cacheErr)
  			}
  			tok = a.authToken.token
  		}
  	}
  
  	return
  }
docs: // currentToken returns last known authentication token (or nil).
  //
  // If the token is not loaded yet, will attempt to load it from the on-disk
  // cache. Returns nil if it's not there.
  //
  // It lock a.lock inside. It MUST NOT be called when a.lock is held. It will
  // lazily call 'ensureInitialized' if necessary, returning its error.