Yes, the next connect / express middleware is invoked because when the allow is false then the user is directed to the dialog. There I need to be able to access `req.oauth2.info` so that I can show the user which scopes were requested.