docs: function _getToken(opts, cb) {
      assert.string(opts.indexName, 'opts.indexName'); // used for error messages
      assert.string(opts.realm, 'opts.realm');
      assert.optionalString(opts.service, 'opts.service');
      assert.optionalArrayOfString(opts.scopes, 'opts.scopes');
      assert.optionalString(opts.username, 'opts.username');
      assert.optionalString(opts.password, 'opts.password');
      // HTTP client opts:
      assert.object(opts.log, 'opts.log');
      assert.optionalObject(opts.agent, 'opts.agent');
      // assert.optional object or bool(opts.proxy, 'opts.proxy');
      assert.optionalBool(opts.insecure, 'opts.insecure');
      assert.optionalString(opts.userAgent, 'opts.userAgent');
      var log = opts.log;
  
      // - add https:// prefix (or http) if none on 'realm'
      var tokenUrl = opts.realm;
      var match = /^(\w+):\/\//.exec(tokenUrl);
      if (!match) {
          tokenUrl = (opts.insecure ? 'http' : 'https') + '://' + tokenUrl;
      } else if (['http', 'https'].indexOf(match[1]) === -1) {
          return cb(new Error(fmt('unsupported scheme for ' +
              'WWW-Authenticate realm "%s": "%s"', opts.realm, match[1])));
      }
  
      // - GET $realm
      //      ?service=$service
      //      (&scope=$scope)*
      //      (&account=$username)
      //   Authorization: Basic ...
      var headers = {};
      var query = {};
      if (opts.service) {
          query.service = opts.service;
      }
      if (opts.scopes && opts.scopes.length) {
          query.scope = opts.scopes;  // intentionally singular 'scope'
      }
  
      if (opts.username) {
          query.account = opts.username;
          _setAuthHeaderFromAuthInfo(headers, {
              username: opts.username,
              password: opts.password
          });
      }
      if (Object.keys(query).length) {
          tokenUrl += '?' + querystring.stringify(query);
      }
      log.trace({tokenUrl: tokenUrl}, '_getToken: url');
  
      var parsedUrl = mod_url.parse(tokenUrl);
      var client = new DockerJsonClient({
          url: parsedUrl.protocol + '//' + parsedUrl.host,
          log: log,
          agent: opts.agent,
          proxy: opts.proxy,
          rejectUnauthorized: !opts.insecure,
          userAgent: opts.userAgent || common.DEFAULT_USERAGENT
      });
      client.get({
          path: parsedUrl.path,
          headers: headers
      }, function (err, req, res, body) {
          client.close();
          if (err) {
              if (err.statusCode === 401) {
                  // Convert *all* 401 errors to use a generic error constructor
                  // with a simple error message.
                  var errMsg = _getRegistryErrorMessage(err);
                  return cb(new errors.UnauthorizedError(errMsg));
              }
              return cb(err);
          } else if (!body.token) {
              return cb(new errors.UnauthorizedError(err, 'authorization ' +
                  'server did not include a token in the response'));
          }
          cb(null, body.token);
      });
  }