oauth2: Add Box to the list of broken OAuth providers.

Change-Id: I85f44714ec0571dc0358aecdc1cde92dca954da0
Reviewed-on: https://go-review.googlesource.com/8830
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
diff --git a/internal/token.go b/internal/token.go
index 8bb467e..2ed6bd3 100644
--- a/internal/token.go
+++ b/internal/token.go
@@ -106,6 +106,7 @@
 	"https://oauth.sandbox.trainingpeaks.com/",
 	"https://oauth.trainingpeaks.com/",
 	"https://www.strava.com/oauth/",
+	"https://app.box.com/",
 }
 
 // providerAuthHeaderWorks reports whether the OAuth2 server identified by the tokenURL