Correct box.com API domain, which still doesn't support Authorization header

Box.com OAuth authorization fails stating "invalid client credentials". Correct API domain is "api.box.com" (source: https://developer.box.com/reference#token)

Change-Id: Icecd02017c44140c85186fcc3cd673cd1e24ecf0
GitHub-Last-Rev: b568688
GitHub-Pull-Request: #313
Reviewed-on: https://go-review.googlesource.com/129537
Reviewed-by: Brad Fitzpatrick <[email protected]>

Author: hoyes

internal/token.go

@@ -103,6 +103,7 @@ var brokenAuthHeaderProviders = []string{
 	"https://api.twitch.tv/",
 	"https://id.twitch.tv/",
 	"https://app.box.com/",
+	"https://api.box.com/",
 	"https://connect.stripe.com/",
 	"https://login.mailchimp.com/",
 	"https://login.microsoftonline.com/",