code: func HandleErrorResponse(resp *http.Response) error {
  	if resp.StatusCode >= 400 && resp.StatusCode < 500 {
  		// Check for OAuth errors within the `WWW-Authenticate` header first
  		// See https://tools.ietf.org/html/rfc6750#section-3
  		for _, c := range challenge.ResponseChallenges(resp) {
  			if c.Scheme == "bearer" {
  				var err errcode.Error
  				// codes defined at https://tools.ietf.org/html/rfc6750#section-3.1
  				switch c.Parameters["error"] {
  				case "invalid_token":
  					err.Code = errcode.ErrorCodeUnauthorized
  				case "insufficient_scope":
  					err.Code = errcode.ErrorCodeDenied
  				default:
  					continue
  				}
  				if description := c.Parameters["error_description"]; description != "" {
  					err.Message = description
  				} else {
  					err.Message = err.Code.Message()
  				}
  
  				return mergeErrors(err, parseHTTPErrorResponse(resp.StatusCode, resp.Body))
  			}
  		}
  		err := parseHTTPErrorResponse(resp.StatusCode, resp.Body)
  		if uErr, ok := err.(*UnexpectedHTTPResponseError); ok && resp.StatusCode == 401 {
  			return errcode.ErrorCodeUnauthorized.WithDetail(uErr.Response)
  		}
  		return err
  	}
  	return &UnexpectedHTTPStatusError{Status: resp.Status}
  }
docs: // HandleErrorResponse returns error parsed from HTTP response for an
  // unsuccessful HTTP response code (in the range 400 - 499 inclusive). An
  // UnexpectedHTTPStatusError returned for response code outside of expected
  // range.