routes/oauth2.js
function(req, res, next) {

    var props = getProps(req.body);

    var retry = function(message) {
        req.session.oauth2AuthcError = message;
        res.redirect(303, "/oauth2/authc?" + qs.stringify(props));
    };

    // if we're logged in (back button?) just go to /oauth2/authz

    if (req.principal) {
        // XXX make sure we don't have a mutual redirect loop here.
        res.redirect(303, "/oauth2/authz?" + qs.stringify(props));
        return;
    }

    // Check all the passed-in properties

    verifyProps(props, function(err, client) {
        if (err) {
            // At this point in the flow, they should have all been checked
            // already. So any validation problem is due to naughty behaviour.
            return next(err);
        } else {
            var nickname = req.body.nickname;
            var password = req.body.password;

            if (!nickname || !password) {
                return retry("nickname and password are required.");
            }

            Step(
                function() {
                    User.checkCredentials(nickname, password, this);
                },
                function(err, user) {
                    if (err) throw err;
                    if (!user) {
                        retry("No match for that nickname and password.");
                    } else {
                        req.principal = user.profile;
                        req.principalUser = user;
                        res.locals.principal = user.profile;
                        res.locals.principalUser = user;
                        authc.setPrincipal(req.session, user.profile, this);
                    }
                },
                function(err) {
                    if (err) return next(err);
                    // XXX make sure we don't have a mutual redirect loop here.
                    res.redirect(303, "/oauth2/authz?" + qs.stringify(props));
                }
            );
        }
    });
}
function(req, res, next) {

    var props = getProps(req.body);

    var retry = function(message) {
        req.session.oauth2AuthcError = message;
        res.redirect(303, "/oauth2/authc?" + qs.stringify(props));
    };

    // if we're logged in (back button?) just go to /oauth2/authz

    if (req.principal) {
        // XXX make sure we don't have a mutual redirect loop here.
        res.redirect(303, "/oauth2/authz?" + qs.stringify(props));
        return;
    }

    // Check all the passed-in properties

    verifyProps(props, function(err, client) {
        if (err) {
            // At this point in the flow, they should have all been checked
            // already. So any validation problem is due to naughty behaviour.
            return next(err);
        } else {
            var nickname = req.body.nickname;
            var password = req.body.password;

            if (!nickname || !password) {
                return retry("nickname and password are required.");
            }

            Step(
                function() {
                    User.checkCredentials(nickname, password, this);
                },
                function(err, user) {
                    if (err) throw err;
                    if (!user) {
                        retry("No match for that nickname and password.");
                    } else {
                        req.principal = user.profile;
                        req.principalUser = user;
                        res.locals.principal = user.profile;
                        res.locals.principalUser = user;
                        authc.setPrincipal(req.session, user.profile, this);
                    }
                },
                function(err) {
                    if (err) return next(err);
                    // XXX make sure we don't have a mutual redirect loop here.
                    res.redirect(303, "/oauth2/authz?" + qs.stringify(props));
                }
            );
        }
    });
}
POST /oauth2/authc nickname=...&password=...&response_type=code&redirect_uri=...&client_id=...&scope=...&state=...