code: @Override
    protected String getToken() {
      GetAccessTokenResult token = accessToken.get();
      if (token == null || isExpired(token)
          || (isAboutToExpire(token) && refreshInProgress.compareAndSet(false, true))) {
        lock.lock();
        try {
          token = accessToken.get();
          if (token == null || isAboutToExpire(token)) {
            token = accessTokenProvider.getNewAccessToken(oauthScopes);
            accessToken.set(token);
            cacheExpirationHeadroom.set(getNextCacheExpirationHeadroom());
          }
        } finally {
          refreshInProgress.set(false);
          lock.unlock();
        }
      }
      return token.getAccessToken();
    }
docs: Attempts to return the token from cache. If this is not possible because it is expired or was
  never assigned, a new token is requested and parallel requests will block on retrieving a new
  token. As such no guarantee of maximum latency is provided.
  
  To avoid blocking the token is refreshed before it's expiration, while parallel requests
  continue to use the old token.