I misread this the first time.. there are cases where the oauth server CANNOT return the user to the client, because the redirect URI is invalid, and redirecting the user there would be a security concern.

This may not be worth going into, but I at least want to clarify that only when the user explicitly rejects the authorization request does the request *always* redirect back to the redirect_uri