Token refresh can cause automatic authStyle detection to break

[codablock]

retrieveToken is called in two situations:

1. When the initial token is exchanged (https://github.com/golang/oauth2/blob/master/oauth2.go#L234)
2. When the token is refreshed (https://github.com/golang/oauth2/blob/master/oauth2.go#L275)

In both cases, internal.RetrieveToken is called, which then performs auto-detection of authType when not explicitly configured.

The problem now is, that some providers allow to perform token refresh without additional authentication. They're perfectly happy when the refresh token is valid and thus they successfully return a valid token even when the wrong authType is used. This leads to caching the wrong authStyle when a token refresh is performed BEFORE the first token exchange.

This can happen after the application is restarted while users still have valid refresh tokens (e.g. in the browser session). If the application then issues a token refresh before a new signin is performed, the errornous caching will cause ALL future token exchanges to fail as it will keep using the wrong authStyle.

I encountered this with Azure AD and the v2.0 issuer.