docs: function response(txn, res, next) {
          if (!txn.redirectURI) {
              return next(new Error('Unable to issue redirect for OAuth 2.0 transaction'));
          }
          if (!txn.res.allow) {
              var err = {};
              err.error = 'access_denied';
              if (txn.req && txn.req.state) {
                  err.state = txn.req.state;
              }
  
              var parsed = url.parse(txn.redirectURI);
              parsed.hash = qs.stringify(err);
  
              var location = url.format(parsed);
              return res.redirect(location);
          }
  
          function issued(err, accessToken, params) {
              if (err) {
                  return next(err);
              }
              if (!accessToken) {
                  return next(new AuthorizationError('Request denied by authorization server', 'access_denied'));
              }
  
              var tok = {};
              tok.access_token = accessToken;
              if (params) {
                  utils.merge(tok, params);
              }
              tok.token_type = tok.token_type || 'Bearer';
              if (txn.req && txn.req.state) {
                  tok.state = txn.req.state;
              }
  
              var parsed = url.parse(txn.redirectURI);
              parsed.hash = qs.stringify(tok);
  
              var location = url.format(parsed);
              return res.redirect(location);
          }
  
          // NOTE: In contrast to an authorization code grant, redirectURI is not
          //       passed as an argument to the issue callback because it is not used
          //       as a verifier in a subsequent token exchange.  However, when
          //       issuing an implicit access tokens, an application must ensure that
          //       the redirection URI is registered, which can be done in the
          //       `validate` callback of `authorization` middleware.
  
          try {
              var arity = issue.length;
              if (arity === 5) {
                  issue(txn.client, txn.user, txn.req.scope, txn.res, issued);
              } else { // arity == 4
                  issue(txn.client, txn.user, txn.req.scope, issued);
              }
          } catch (ex) {
              return next(ex);
          }
      }