You're assuming that's the only thing it will ever do. Just because you saw that particular code doesn't mean that's the same code served for every possible user.
It's strange that the <span> in the login object is never used. Also that the handleAuth function uses the existence of 'logoutUrl' to decide wether it should refresh or redirect, but uses it for nothing else.
https://foobar.withgoogle.com/staticfiles/js/landing.5252068... : !function(){ "use strict"; function a(){ var a=document.getElementById("login"); a.addEventListener("click",function(a){a.preventDefault(),window.launchPopup()},!1)} window.handleAuth=function(a){ a.logoutUrl ? window.location.href=a.redirectUrl : window.location.reload() }, window.launchPopup=function(){ window.open("/login/","AppLogin","resizable,scrollbars,status,width=600,height=400") }, a() } ();
This script handles the login. a object looks something like this : Object { message: "<span class="term-red">Error(6): Login unavailable. Try again later.</span>", logoutUrl: "https://foobar.withgoogle.com/_ah/logout?continue=…ps://foob..., redirectUrl: "/denied/", allow: false}allow: falselogoutUrl: "https://foobar.withgoogle.com/_ah/logout?continue=https://ww...: "<span class="term-red">Error(6): Login unavailable. Try again later.</span>" redirectUrl: "/denied/" }
handleAuth() function will either take you tohttps://foobar.withgoogle.com/denied/ or just reload the page.
Google is just getting a tonne of analytics data.