code: func untrustedIssuer(token string) (string, error) {
  	parts := strings.Split(token, ".")
  	if len(parts) != 3 {
  		return "", fmt.Errorf("malformed token")
  	}
  	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
  	if err != nil {
  		return "", fmt.Errorf("error decoding token: %v", err)
  	}
  	claims := struct {
  		// WARNING: this JWT is not verified. Do not trust these claims.
  		Issuer string `json:"iss"`
  	}{}
  	if err := json.Unmarshal(payload, &claims); err != nil {
  		return "", fmt.Errorf("while unmarshaling token: %v", err)
  	}
  	// Coalesce the legacy GoogleIss with the new one.
  	//
  	// http://openid.net/specs/openid-connect-core-1_0.html#GoogleIss
  	if claims.Issuer == "accounts.google.com" {
  		return "https://accounts.google.com", nil
  	}
  	return claims.Issuer, nil
  }
docs: // untrustedIssuer extracts an untrusted "iss" claim from the given JWT token,
  // or returns an error if the token can not be parsed.  Since the JWT is not
  // verified, the returned issuer should not be trusted.