code: func (p *Proxy) handleTunnel(session sockjs.Session, req *http.Request) {
  	tokenString := req.URL.Query().Get("token")
  
  	getPublicKey := func(token *jwt.Token) (interface{}, error) {
  		if _, ok := token.Method.(*jwt.SigningMethodRSA); !ok {
  			return nil, errors.New("invalid signing method")
  		}
  
  		return jwt.ParseRSAPublicKeyFromPEM([]byte(p.pubKey))
  	}
  
  	token, err := jwt.Parse(tokenString, getPublicKey)
  	if err != nil {
  		p.Kite.Log.Error("Invalid token: \"%s\"", tokenString)
  		return
  	}
  
  	kiteID := token.Claims.(jwt.MapClaims)["sub"].(string)
  	seq := uint64(token.Claims.(jwt.MapClaims)["seq"].(float64))
  
  	client, ok := p.kites[kiteID]
  	if !ok {
  		p.Kite.Log.Error("Remote kite is not found: %s", kiteID)
  		return
  	}
  
  	tunnel, ok := client.tunnels[seq]
  	if !ok {
  		p.Kite.Log.Error("Tunnel not found: %d", seq)
  	}
  
  	go tunnel.Run(session)
  
  	<-tunnel.CloseNotify()
  
  }
docs: // handleTunnel is the PrivateKite side of the Tunnel (on private network).