If the `decision` middleware is reached, it means an immediate response was not allowed.  In this case, the "authorization response" should be determined solely based on what the user chooses to allow.  It should not be built from anything in the original "authorization request" sent by the app.

In effect, with your modifications, the results supplied by the immediate callback are interpreted based on the `allow` flag.  If true, it is the response to be immediately sent.  If false, it is some extra info the application wants to carry through the transaction.  In the latter case, this info should be *entirely opaque* to oauth2orize.  It has no meaning other than what the application chooses to associate with it, which is why the `parse` function should be used to parse any data from within it.

If the two noted lines can be changed, I'm happy and will get this merged.  Thanks for your efforts, and the discussion.  OAuth is, unfortunately, quite hard to grasp and has a lot of stuff the application is ultimately responsible for.  I'm just trying to keep this module as un-assuming as possible, and keep those divisions clear.