docs: function response(txn, res, next) {
          if (!txn.redirectURI) {
              return next(new Error('Unable to issue redirect for OAuth 2.0 transaction'));
          }
          if (!txn.res.allow) {
              var parsed = url.parse(txn.redirectURI, true);
              delete parsed.search;
              parsed.query.error = 'access_denied';
              if (txn.req && txn.req.state) {
                  parsed.query.state = txn.req.state;
              }
  
              var location = url.format(parsed);
              return res.redirect(location);
          }
  
          function issued(err, code) {
              if (err) {
                  return next(err);
              }
              if (!code) {
                  return next(new AuthorizationError('Request denied by authorization server', 'access_denied'));
              }
  
              var parsed = url.parse(txn.redirectURI, true);
              delete parsed.search;
              parsed.query.code = code;
              if (txn.req && txn.req.state) {
                  parsed.query.state = txn.req.state;
              }
  
              var location = url.format(parsed);
              return res.redirect(location);
          }
  
          // NOTE: The `redirect_uri`, if present in the client's authorization
          //       request, must also be present in the subsequent request to exchange
          //       the authorization code for an access token.  Acting as a verifier,
          //       the two values must be equal and serve to protect against certain
          //       types of attacks.  More information can be found here:
          //
          //       http://hueniverse.com/2011/06/oauth-2-0-redirection-uri-validation/
  
          try {
              // console.log(issue.toString());
              var arity = issue.length;
              if (arity === 6) {
                  issue(txn.client, txn.req.redirectURI, txn.user, txn.req.scope, txn.res, issued);
              } else { // arity == 5
                  issue(txn.client, txn.req.redirectURI, txn.user, txn.req.scope, issued);
              }
          } catch (ex) {
              return next(ex);
          }
      }