code: func serveRef(rw http.ResponseWriter, req *http.Request, ref blob.Ref, fetcher blob.Fetcher) {
  
  	if !httputil.IsGet(req) {
  		http.Error(rw, "Invalid download method.", 400)
  		return
  	}
  
  	if !httputil.IsLocalhost(req) {
  		http.Error(rw, "Forbidden.", 403)
  		return
  	}
  
  	parts := strings.Split(req.URL.Path, "/")
  	if len(parts) < 2 {
  		http.Error(rw, "Malformed GET URL.", 400)
  		return
  	}
  
  	blobRef, ok := blob.Parse(parts[1])
  	if !ok {
  		http.Error(rw, "Malformed GET URL.", 400)
  		return
  	}
  
  	// only serves its ref
  	if blobRef != ref {
  		log.Printf("videothumbnail: access to %v forbidden; wrong blobref for handler", blobRef)
  		http.Error(rw, "Forbidden.", 403)
  		return
  	}
  
  	rw.Header().Set("Content-Type", "application/octet-stream")
  
  	fr, err := schema.NewFileReader(req.Context(), fetcher, ref)
  	if err != nil {
  		httputil.ServeError(rw, req, err)
  		return
  	}
  	defer fr.Close()
  
  	http.ServeContent(rw, req, "", time.Now(), fr)
  }
docs: // serveRef gets the file at ref from fetcher and serves its contents.
  // It is used by Service as a one time handler to serve to the thumbnail child process on localhost.