oauth2: expire the tokens 10 seconds earlier

It avoids the late expiration due to the server time mismatch.

Change-Id: I126a76cff112fbeb92b71dd036195555b20e637b
Reviewed-on: https://go-review.googlesource.com/3307
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

token_test.go

@@ -4,7 +4,10 @@
 
 package oauth2
 
-import "testing"
+import (
+	"testing"
+	"time"
+)
 
 func TestTokenExtra(t *testing.T) {
 	type testCase struct {
@@ -28,3 +31,20 @@ func TestTokenExtra(t *testing.T) {
 		}
 	}
 }
+
+func TestTokenExpiry(t *testing.T) {
+	now := time.Now()
+	cases := []struct {
+		name string
+		tok  *Token
+		want bool
+	}{
+		{name: "12 seconds", tok: &Token{Expiry: now.Add(12 * time.Second)}, want: false},
+		{name: "10 seconds", tok: &Token{Expiry: now.Add(expiryDelta)}, want: true},
+	}
+	for _, tc := range cases {
+		if got, want := tc.tok.expired(), tc.want; got != want {
+			t.Errorf("expired (%q) = %v; want %v", tc.name, got, want)
+		}
+	}
+}