'Encrypt user-metadata header values. Replace each x-object-meta-<key>
user metadata header with a corresponding
x-object-transient-sysmeta-crypto-meta-<key> header which has the
crypto metadata required to decrypt appended to the encrypted value.
:param req: a swob Request
:param keys: a dict of encryption keys'

def encrypt_user_metadata(self, req, keys):

    prefix = get_object_transient_sysmeta('crypto-meta-')
    user_meta_headers = [h for h in req.headers.items() if (is_user_meta(self.server_type, h[0]) and h[1])]
    crypto_meta = None
    for (name, val) in user_meta_headers:
        short_name = strip_user_meta_prefix(self.server_type, name)
        new_name = (prefix + short_name)
        (enc_val, crypto_meta) = encrypt_header_val(self.crypto, val, keys[self.server_type])
        req.headers[new_name] = append_crypto_meta(enc_val, crypto_meta)
        req.headers.pop(name)
    if crypto_meta:
        meta = dump_crypto_meta({'cipher': crypto_meta['cipher'], 'key_id': keys['id']})
        req.headers[get_object_transient_sysmeta('crypto-meta')] = meta
