code: function(accessToken, done) {
      db.accessTokens.find(accessToken, function(err, token) {
        if (err) { return done(err); }
        db.users.find(token.userID, function(err, user) {
          if (err) { return done(err); }
          if (!user) { return done(null, false); }
          // to keep this example simple, restricted scopes are not implemented
          var info = { scope: '*' }
          done(null, user, token.secret, info);
        });
      });
    }
docs: verify callback  This callback finds the user associated with `accessToken`.  The user should be supplied to the `done` callback as the second argument, and the token secret known by the server should be supplied as the third argument. The `TokenStrategy` will use this secret to validate the request signature, failing authentication if it does not match.  Furthermore, additional arbitrary `info` can be passed as the fourth argument to the callback.  An access token will often have associated details such as scope of access, expiration date, etc.  These details can be retrieved from the database during this step.  They will then be made available by Passport at `req.authInfo` and carried through to other middleware and request handlers, avoiding the need to do additional unnecessary queries to the database.  Note that additional access control (such as scope of access), is an authorization step that is distinct and separate from authentication. It is an application's responsibility to enforce access control as necessary.