My Go is rusty, but this look a little error prone:

    // Note that this will create a new UUID each time its .String() method
    // is invoked.
    fmt.Printf("%s", u)  // Cekw67uyMpBGZLRP2HFVbe
    fmt.Printf("%s", u)  // 4pUYNRFHTG3YVgThPZvCgC

Just imagine an user using u directly instead of assigning to a var:

    token := "secret" + u
    othertoken := "app" + u