auth_context: fix ContextWithoutProjects helper

There's no need to translate incoming MD to outgoing MD. Outgoing
metadata is only required if another grpc CLIENT call uses that context,
and the key-val pairs are supposed to be sent along.

Also fixes the comment.

Signed-off-by: Stephan Renatus <[email protected]>

lib/grpc/auth_context/auth_context.go

@@ -102,14 +102,14 @@ func ProjectsFromMetadata(md metadata.MD) []string {
 	return ps
 }
 
-// ContextWithoutProjects removes previously added projects from the GRPC metadata
-// for those system operations that must not be filtered by projects.
+// ContextWithoutProjects removes any projects from the incoming GRPC metadata
+// attached to the context. Following attempts to read projects from incoming
+// metadata will yield nothing -- so this can be used in handlers that should
+// not do projects filtering, but would do that if the key was present.
 func ContextWithoutProjects(ctx context.Context) context.Context {
-	// This will fail on service start context, so only remove projects if ok.
 	md, ok := metadata.FromIncomingContext(ctx)
 	if ok {
 		delete(md, "projects")
-		ctx = metadata.NewOutgoingContext(ctx, md)
 	}
 	return ctx
 }