internal: add Twitch's other endpoint to blacklist

Twitch uses two domains for OAuth: https://dev.twitch.tv/docs/authentication/

Change-Id: I33f74e0c282b9e35c5b266980d1eb62f4fa419a8
Reviewed-on: https://go-review.googlesource.com/119515
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
diff --git a/internal/token.go b/internal/token.go
index 30fb315..3954c9b 100644
--- a/internal/token.go
+++ b/internal/token.go
@@ -101,6 +101,7 @@
 	"https://api.pushbullet.com/",
 	"https://api.soundcloud.com/",
 	"https://api.twitch.tv/",
+	"https://id.twitch.tv/",
 	"https://app.box.com/",
 	"https://connect.stripe.com/",
 	"https://login.mailchimp.com/",