Correct box.com API domain, which still doesn't support Authorization header

Box.com OAuth authorization fails stating "invalid client credentials". Correct API domain is "api.box.com" (source: https://developer.box.com/reference#token)

Change-Id: Icecd02017c44140c85186fcc3cd673cd1e24ecf0
GitHub-Last-Rev: b568688a5a4487fb640370f34cc3e2f48467d02b
GitHub-Pull-Request: golang/oauth2#313
Reviewed-on: https://go-review.googlesource.com/129537
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
diff --git a/internal/token.go b/internal/token.go
index 999e668..aeef381 100644
--- a/internal/token.go
+++ b/internal/token.go
@@ -103,6 +103,7 @@
 	"https://api.twitch.tv/",
 	"https://id.twitch.tv/",
 	"https://app.box.com/",
+	"https://api.box.com/",
 	"https://connect.stripe.com/",
 	"https://login.mailchimp.com/",
 	"https://login.microsoftonline.com/",