vendored goauth2, see https://code.google.com/p/goauth2/issues/detail?id=31