code: function(req, res, next) {
  
      var props = getProps(req.body);
  
      var retry = function(message) {
          req.session.oauth2AuthcError = message;
          res.redirect(303, "/oauth2/authc?" + qs.stringify(props));
      };
  
      // if we're logged in (back button?) just go to /oauth2/authz
  
      if (req.principal) {
          // XXX make sure we don't have a mutual redirect loop here.
          res.redirect(303, "/oauth2/authz?" + qs.stringify(props));
          return;
      }
  
      // Check all the passed-in properties
  
      verifyProps(props, function(err, client) {
          if (err) {
              // At this point in the flow, they should have all been checked
              // already. So any validation problem is due to naughty behaviour.
              return next(err);
          } else {
              var nickname = req.body.nickname;
              var password = req.body.password;
  
              if (!nickname || !password) {
                  return retry("nickname and password are required.");
              }
  
              Step(
                  function() {
                      User.checkCredentials(nickname, password, this);
                  },
                  function(err, user) {
                      if (err) throw err;
                      if (!user) {
                          retry("No match for that nickname and password.");
                      } else {
                          req.principal = user.profile;
                          req.principalUser = user;
                          res.locals.principal = user.profile;
                          res.locals.principalUser = user;
                          authc.setPrincipal(req.session, user.profile, this);
                      }
                  },
                  function(err) {
                      if (err) return next(err);
                      // XXX make sure we don't have a mutual redirect loop here.
                      res.redirect(303, "/oauth2/authz?" + qs.stringify(props));
                  }
              );
          }
      });
  }
docs: POST /oauth2/authc nickname=...&password=...&response_type=code&redirect_uri=...&client_id=...&scope=...&state=...