func unmarshal(req *http.Request, pbReq proto.Message) (string, error) {
	var mimeType string
	mediaType, _, err := mime.ParseMediaType(req.Header.Get("Content-Type"))
	if err != nil {
		mediaType = req.Header.Get("Content-Type")
	}
	alt := req.URL.Query().Get("alt")
	if alt == "" {
		alt = mediaType
	}
	switch alt {
	case "json", mimeJSON:
		mimeType = mimeJSON
	case "proto", mimeProto:
		mimeType = mimeProto
	default:
		return mimeType, errors.New("invalid interchange format")
	}
	switch mediaType {
	case mimeJSON:
		if err := jsonpb.Unmarshal(req.Body, pbReq); err != nil {
			return mimeType, err
		}
	case mimeProto:
		body, err := ioutil.ReadAll(req.Body)
		if err != nil {
			return mimeType, err
		}
		if err := proto.Unmarshal(body, pbReq); err != nil {
			return mimeType, err
		}
	}
	return mimeType, nil
}
unmarshal reads pbResp from req. The mime will either be JSON or ProtoBuf.
package main
import (
	"bytes"
	"encoding/json"
	"errors"
	"flag"
	"fmt"
	"html/template"
	"io/ioutil"
	"mime"
	"net/http"
	"net/url"
	"os"
	"github.com/google/safebrowsing"
	pb "github.com/google/safebrowsing/internal/safebrowsing_proto"
	"github.com/golang/protobuf/jsonpb"
	"github.com/golang/protobuf/proto"
	_ "github.com/google/safebrowsing/cmd/sbserver/statik"
	"github.com/rakyll/statik/fs"
)
const (
	statusPath         = "/status"
	findThreatPath     = "/v4/threatMatches:find"
	getThreatListsPath = "/v4/threatLists"
	redirectPath       = "/r"
)
const (
	mimeJSON  = "application/json"
	mimeProto = "application/x-protobuf"
)
var (
	apiKeyFlag   = flag.String("apikey", "", "specify your Safe Browsing API key")
	srvAddrFlag  = flag.String("srvaddr", "localhost:8080", "TCP network address the HTTP server should use")
	proxyFlag    = flag.String("proxy", "", "proxy to use to connect to the HTTP server")
	databaseFlag = flag.String("db", "", "path to the Safe Browsing database.")
)
var threatTemplate = map[safebrowsing.ThreatType]string{
	safebrowsing.ThreatType_Malware:                       "/malware.tmpl",
	safebrowsing.ThreatType_PotentiallyHarmfulApplication: "/malware.tmpl",
	safebrowsing.ThreatType_UnwantedSoftware:              "/unwanted.tmpl",
	safebrowsing.ThreatType_SocialEngineering:             "/social_engineering.tmpl",
}
const usage = `sbserver: starts a Safe Browsing API proxy server.
In order to abstract away the complexities of the Safe Browsing API v4, the
sbserver application can be used to serve a subset of the v4 API.
This subset is intentionally small so that it would be easy to implement by
a client. It is intended for sbserver to either be running locally on a
client's machine or within the same local network so that it can handle most
local API calls before resorting to making an API call to the actual
Safe Browsing API over the internet.
Usage: %s -apikey=$APIKEY
`