Respond with OAuth1 response object, not just access_token and state