code: func VerifyToken(token string, pwdvalFn func(string) ([]byte, error), secret []byte) (login string, err error) {
  	blen := base64.URLEncoding.DecodedLen(len(token))
  	// Avoid allocation if the token is too short
  	if blen <= 4+32 {
  		err = ErrMalformedToken
  		return
  	}
  	b := make([]byte, blen)
  	blen, err = base64.URLEncoding.Decode(b, []byte(token))
  	if err != nil {
  		return
  	}
  	// Decoded length may be bifferent from max length, which
  	// we allocated, so check it, and set new length for b
  	if blen <= 4+32 {
  		err = ErrMalformedToken
  		return
  	}
  	b = b[:blen]
  
  	data := b[:blen-32]
  	exp := time.Unix(int64(binary.BigEndian.Uint32(data[:4])), 0)
  	if exp.Before(time.Now()) {
  		err = ErrExpiredToken
  		return
  	}
  	login = string(data[4:])
  	pwdval, err := pwdvalFn(login)
  	if err != nil {
  		login = ""
  		return
  	}
  	sig := b[blen-32:]
  	sk := getUserSecretKey(pwdval, secret)
  	realSig := getSignature(data, sk)
  	if subtle.ConstantTimeCompare(realSig, sig) != 1 {
  		err = ErrWrongSignature
  		return
  	}
  	return
  }
docs: // VerifyToken verifies the given token with the password value returned by the
  // given function and the given secret key, and returns login extracted from
  // the valid token. If the token is not valid, the function returns an error.
  //
  // Function pwdvalFn must return the current password value for the login it
  // receives in arguments, or an error. If it returns an error, VerifyToken
  // returns the same error.