code: function(req, res, next) {
  
      var props = getProps(req.body);
  
      // Closure to make this a little shorter
      var redirectError = function(type) {
          var qp = {error: type, state: props.state};
          res.redirect(props.redirect_uri + "?" + qs.stringify(qp));
      };
  
      verifyProps(props, function(err, client) {
  
          if (err) {
              next(err);
          } else {
  
              if (!req.principal || !req.principalUser) {
                  return next(new Error("Unexpected login state"));
              }
  
              if (req.body.denied) {
                  req.log.info("OAuth 2.0 access denied");
                  redirectError("access_denied");
              } else {
                  Step(
                      function() {
                          var acprops = {
                              nickname: req.principalUser.nickname,
                              client_id: client.consumer_key,
                              redirect_uri: props.redirect_uri,
                              scope: props.scope
                          };
                          AuthorizationCode.create(acprops, this);
                      },
                      function(err, ac) {
                          if (err) {
                            req.log.error({err: err}, err.message);
                            return redirectError("server_error");
                          }
                          var rprops = {
                              code: ac.code,
                              state: props.state
                          };
                          var rurl = props.redirect_uri +
                              "?" +
                               qs.stringify(rprops);
                          res.redirect(303, rurl);
                      }
                  );
              }
          }
      });
  }
docs: POST /oauth2/authz response_type=code&redirect_uri=...&client_id=...&scope=...&state=...