code: function(req, res, next) {
  
      var props = getProps(req.query);
  
      // if we're logged in (back button?) just go to /oauth2/authz
  
      if (req.principal) {
          // XXX make sure we don't have a mutual redirect loop here.
          res.redirect("/oauth2/authz?" + qs.stringify(props));
          return;
      }
  
      // Check all the passed-in properties
  
      verifyProps(props, function(err, client) {
          if (err) {
              // At this point in the flow, they should have all been checked
              // already. So any validation problem is due to naughty behaviour.
              return next(err);
          } else {
              var aprops = _.extend(props, {
                  client: client,
                  error: req.session.oauth2AuthcError
              });
              res.render("oauth2-authenticate", aprops);
          }
      });
  }
docs: GET /oauth2/authc?response_type=code&redirect_uri=...&client_id=...&scope=...&state=...