code: func newTokenInjector(meta *metadata.Client, acc string) func(*http.Request) error {
  	if acc == "" {
  		acc = "default"
  	}
  	acc = url.PathEscape(acc)
  	return func(req *http.Request) error {
  		aud := fmt.Sprintf("%s://%s", req.URL.Scheme, req.URL.Host)
  		aud = url.QueryEscape(aud)
  		// TODO(smut): Cache the token and reuse if not yet expired.
  		// Currently the only user of this package only makes one
  		// request per boot so caching isn't too important yet.
  		tok, err := meta.Get(fmt.Sprintf(tokMetadata, acc, aud))
  		if err != nil {
  			return err
  		}
  		req.Header.Set(vmtoken.Header, tok)
  		return nil
  	}
  }
docs: // newTokenInjector returns a function which can modify the Header of an
  // *http.Request to include a GCE VM metadata token for the given account.