code: function(req, res, next) {
  
      var props = getProps(req.query);
  
      // Closure to make this a little shorter
      var redirectError = function(type) {
          var qp = {error: type, state: props.state};
          res.redirect(props.redirect_uri + "?" + qs.stringify(qp));
      };
  
      verifyProps(props, function(err, client) {
          if (err) {
              if (err instanceof RedirectError) {
                  req.log.error({err: err}, "Couldn't verify props");
                  redirectError(err.type);
              } else {
                  next(err);
              }
          } else {
  
              // Check login state
  
              if (!req.principal) {
                  // Not logged in; login and come back
                  res.redirect("/oauth2/authc?" + qs.stringify(props));
              } else if (!req.principalUser) {
                  // Remote user
                  req.log.error("OAuth 2.0 authorization for remote user");
                  return redirectError("invalid_request");
              } else {
                  var aprops = _.extend(props, {
                      client: client
                  });
                  res.render("oauth2-authorize", aprops);
              }
          }
      });
  }
docs: GET /oauth2/authz?response_type=code&redirect_uri=...&client_id=...&scope=...&state=...