Yes, I get that, and that's what setting info on the transaction accomplishes at L167, which will be available in the next middleware at `req.oauth2.info`.  My issue is with L140, which seems unnecessary.  There is no need to set `info` when allow is true,  because the response is sent immediately and no further middleware gets invoked.