Avoid racing to refresh the token and add refresh hysteresis.

Currently, if the oauth2 Transport is used concurrently, and a token
refresh occurs, the token refresh procedure can be invoked multiple
times.

The token is also refreshed exactly at expiration - clock skew on the
client may attempt to use an already expired token which a strict
server implementation would reject. The hysteresis is currently static.
This is ineffective as token has not been reassigned to t.token therefore you are missing the possible update to t.token.  Both the twoStep and threeStep functions create a new Token rather than update the current token.