code: function(req, res) {
      var params = URL.parse(req.url, true).query
        , code = params.code
        , state = params.state
      ;
  
      if(!code) {
        res.writeHead(400, {'Content-Type': 'text/plain'});
        return res.end('The "code" parameter is missing.');
      }
      if(!state) {
        res.writeHead(400, {'Content-Type': 'text/plain'});
        return res.end('The "state" parameter is missing.');
      }
      try {
        state = this.serializer.parse(state);
      } catch(err) {
        res.writeHead(400, {'Content-Type': 'text/plain'});
        return res.end('The "state" parameter is invalid.');
      }
      var data = {
        oauth2_server_id: state[0]
        , next_url: state[1]
        , state: state[2]
      }
      var methods = this.methods[data.oauth2_server_id];
      methods.valid_grant(data, code, function(err, token) {
        if (err) return server_error(res, err);
        if(!token) {
          res.writeHead(400, {'Content-Type': 'text/plain'});
          res.end('Invalid grant.');
          return;
        }
        data.token = token;
        methods.treat_access_token(data, req, res, function() {
          redirect(res, data.next_url);
        }, function(err){server_error(res, err)});
      });
    }
docs: Check the grant given by user to login in authserver is a good one.
  
  Arguments:
  - req
  - res