code: def BuildToken(request, execution_time):
      
  
      # The request.args dictionary will also be filled on HEAD calls.
      if request.method in ["GET", "HEAD"]:
        reason = request.args.get("reason", "")
      elif request.method in ["POST", "DELETE", "PATCH"]:
        # The header X-GRR-Reason is set in api-service.js.
        reason = utils.SmartUnicode(
            urlparse.unquote(request.headers.get("X-Grr-Reason", "")))
  
      # We assume that request.user contains the username that we can trust.
      # No matter what authentication method is used, the WebAuthManager is
      # responsible for authenticating the userand setting request.user to
      # a correct value (see gui/webauth.py).
      #
      # The token that's built here will be later used to find an API router,
      # get the ApiCallHandler from the router, and then to call the handler's
      # Handle() method. API router will be responsible for all the ACL checks.
      token = access_control.ACLToken(
          username=request.user,
          reason=reason,
          process="GRRAdminUI",
          expiry=rdfvalue.RDFDatetime.Now() + execution_time)
  
      for field in ["Remote_Addr", "X-Forwarded-For"]:
        remote_addr = request.headers.get(field, "")
        if remote_addr:
          token.source_ips.append(remote_addr)
      return token
docs: Build an ACLToken from the request.