code: func (secret hmacKey) unpackUploadState(token string) (blobUploadState, error) {
  	var state blobUploadState
  
  	tokenBytes, err := base64.URLEncoding.DecodeString(token)
  	if err != nil {
  		return state, err
  	}
  	mac := hmac.New(sha256.New, []byte(secret))
  
  	if len(tokenBytes) < mac.Size() {
  		return state, errInvalidSecret
  	}
  
  	macBytes := tokenBytes[:mac.Size()]
  	messageBytes := tokenBytes[mac.Size():]
  
  	mac.Write(messageBytes)
  	if !hmac.Equal(mac.Sum(nil), macBytes) {
  		return state, errInvalidSecret
  	}
  
  	if err := json.Unmarshal(messageBytes, &state); err != nil {
  		return state, err
  	}
  
  	return state, nil
  }
docs: // unpackUploadState unpacks and validates the blob upload state from the
  // token, using the hmacKey secret.