Avoid racing to refresh the token and add refresh hysteresis.

Currently, if the oauth2 Transport is used concurrently, and a token
refresh occurs, the token refresh procedure can be invoked multiple
times.

The token is also refreshed exactly at expiration - clock skew on the
client may attempt to use an already expired token which a strict
server implementation would reject. The hysteresis is currently static.
Thanks - testing showed the same flaw in my plan. I'll patch it up.