code: func (a *Authenticator) maybeRefreshCreds(creds *credentials, r *clientauthentication.Response) error {
  	a.mu.Lock()
  	defer a.mu.Unlock()
  
  	// Since we're not making a new pointer to a.cachedCreds in getCreds, no
  	// need to do deep comparison.
  	if creds != a.cachedCreds {
  		// Credentials already rotated.
  		return nil
  	}
  
  	return a.refreshCredsLocked(r)
  }
docs: // maybeRefreshCreds executes the plugin to force a rotation of the
  // credentials, unless they were rotated already.