docs: function Strategy(options, verify) {
    options = options || {};
    options.name = options.name || 'citrix-auth-service';
    options.profileURL = options.profileURL || 'https://account.citrixonline.com/identity/v1/Users/me';
    options.authorizationURL = options.authorizationURL || 'https://authentication.citrixonline.com/oauth/authorize';
    options.tokenURL = options.tokenURL || 'https://authentication.citrixonline.com/oauth/token';
    options.customHeaders = options.customHeaders || {};
    
    OAuth2Strategy.call(this, options, verify);
    this.name = options.name;
    this.profileURL = options.profileURL;
    this._oauth2.useAuthorizationHeaderforGET(true);
  
    var generateAuthHeader = function(clientId, clientSecret) {
      var token = new Buffer(clientId + ':' + clientSecret).toString("base64");
      return 'Basic ' + token;
    };
  
    this._oauth2.getOAuthAccessToken = function(code, params, callback) {
      var params= params || {};
      var codeParam = (params.grant_type === 'refresh_token') ? 'refresh_token' : 'code';
      params[codeParam] = code;
      var requestBody = querystring.stringify(params);
  
      var requestHeader = {};
      requestHeader['Authorization'] = generateAuthHeader(this._clientId, this._clientSecret);
      requestHeader['Content-Type'] = 'application/x-www-form-urlencoded';
  
      this._request("POST", this._getAccessTokenUrl(), requestHeader, requestBody, null, function(error, data, response) {
        if( error )  callback(error);
        else {
          var results;
          try {
            // As of http://tools.ietf.org/html/draft-ietf-oauth-v2-07
            // responses should be in JSON
            results= JSON.parse( data );
          }
          catch(e) {
            // .... However both Facebook + Github currently use rev05 of the spec
            // and neither seem to specify a content-type correctly in their response headers :(
            // clients of these services will suffer a *minor* performance cost of the exception
            // being thrown
            results= querystring.parse( data );
          }
          var access_token= results["access_token"];
          var refresh_token= results["refresh_token"];
          delete results["refresh_token"];
          callback(null, access_token, refresh_token, results); // callback results =-=
        }
      });
    }
  }