oauth2: fix typo in Token docs and clarify mutability of Token

Change-Id: I1093cffbd4b6fe25cd5b7cfb31e820b15fcfa41f
Reviewed-on: https://go-review.googlesource.com/2197
Reviewed-by: Burcu Dogan <jbd@google.com>

oauth2.go

@@ -61,6 +61,7 @@ type Config struct {
 type TokenSource interface {
 	// Token returns a token or an error.
 	// Token must be safe for concurrent use by multiple goroutines.
+	// The returned Token must not be modified.
 	Token() (*Token, error)
 }