Runtime error when attempting to read *http.Response Body, having used urlfetch.Transport

App Engine does not allow use of DefaultClient, providing the urlfetch service instead. The following minimal example deploys and works pretty much as expected:

package app

import (
	"fmt"
	"net/http"
	"appengine"
	"appengine/urlfetch"
	"code.google.com/p/goauth2/oauth"
)

func init () {
	http.HandleFunc("/", home)
}

func home(w http.ResponseWriter, r *http.Request) {
	c := appengine.NewContext(r)
	config := &oauth.Config{
		ClientId:     "<redacted>",
		ClientSecret: "<redacted>",
		Scope:        "email",
		AuthURL:      "https://www.facebook.com/dialog/oauth",
		TokenURL:     "https://graph.facebook.com/oauth/access_token",
		RedirectURL:  "http://example.com/",
	}

	code := r.FormValue("code")
	if code == "" {
		http.Redirect(w, r, config.AuthCodeURL("foo"), http.StatusFound)
	}
	t := &oauth.Transport{Config: config, Transport: &urlfetch.Transport{Context: c}}
	tok, _ := t.Exchange(code)
	graphResponse, _ := t.Client().Get("https://graph.facebook.com/me")

	fmt.Fprintf(w, "<pre>%s<br />%s</pre>", tok, graphResponse)
}

With correct ClientId, ClientSecret and RedirectURL, this produces the following output (edited for brevity):

&{AAADTWGsQ5<snip>kMdjh5VKwZDZD  0001-01-01 00:00:00 +0000 UTC}

&{200 OK %!s(int=200) HTTP/1.1 %!s(int=1) %!s(int=1) 
map[Connection:[keep-alive] Access-Control-Allow-Origin:[*] 
<snip>
Content-Type:[text/javascript; charset=UTF-8] 
Date:[Wed, 06 Feb 2013 12:06:45 GMT] X-Google-Cache-Control:[remote-fetch] 
Cache-Control:[private, no-cache, no-store, must-revalidate] Pragma:[no-cache] 
X-Fb-Rev:[729873] Via:[HTTP/1.1 GWA] Expires:[Sat, 01 Jan 2000 00:00:00 GMT]] 
%!s(*urlfetch.bodyReader=&{[123 34 105 100 <big snip> 48 48 34 125] false false}) 
%!s(int64=306) [] %!s(bool=true) map[] %!s(*http.Request=&{GET 0xf840087230 
HTTP/1.1 1 1 map[Authorization:[Bearer AAADTWGsQ5NsBAC4yT0x1shZAJAtODOIx0tZCb
TYTjxFC4esEqCjPDi3REMKHBUjZCX4FIKLO1UjMpJxhJZCfGFcOJlFu7UvehkMdjh5VKwZDZD]]
  0 [] false graph.facebook.com map[]  map[]   })}

It certainly seems like I'm consistently getting an *http.Response back, so I would expect to be able to read from the response Body. However, any mention of Body--for example with:

defer graphResponse.Body.Close()

compiles, deploys, but results in the following runtime error:

panic: runtime error: invalid memory address or nil pointer dereference
runtime.panic go/src/pkg/runtime/proc.c:1442
runtime.panicstring go/src/pkg/runtime/runtime.c:128
runtime.sigpanic go/src/pkg/runtime/thread_linux.c:199
app.home app/app.go:33
net/http.HandlerFunc.ServeHTTP go/src/pkg/net/http/server.go:704
net/http.(*ServeMux).ServeHTTP go/src/pkg/net/http/server.go:942
appengine_internal.executeRequestSafely go/src/pkg/appengine_internal/api_prod.go:240
appengine_internal.(*server).HandleRequest go/src/pkg/appengine_internal/api_prod.go:190
reflect.Value.call go/src/pkg/reflect/value.go:526
reflect.Value.Call go/src/pkg/reflect/value.go:334
_ _.go:316
runtime.goexit go/src/pkg/runtime/proc.c:270

What am I missing? Is this because of the use of urlfetch rather than DefaultClient?

Okay, this was of course my own silly fault but I can see how others could fall into the same trap so here's the solution, prompted by Andrew Gerrand and Kyle Lemons in this google-appengine-go topic (thanks guys).

First of all, I wasn't handling requests to favicon.ico. That can be taken care of by following the instructions here and adding a section to app.yaml:

- url: /favicon\.ico
  static_files: images/favicon.ico
  upload: images/favicon\.ico

This fixed panics on favicon requests, but not panics on requests to '/'. Problem was, I'd assumed that an http.Redirect ends handler execution at that point. It doesn't. What was needed was either a return statement following the redirect, or an else clause:

code := r.FormValue("code")
if code == "" {
	http.Redirect(w, r, config.AuthCodeURL("foo"), http.StatusFound)
} else {
	t := &oauth.Transport{Config: config, Transport: &urlfetch.Transport{Context: c}}
	tok, _ := t.Exchange(code)

	fmt.Fprintf(w, "%s", tok.AccessToken)
	// ...
}

I don't recommend ignoring the error of course but this deploys and runs as expected, producing a valid token.