I don't like this.  If you want the authorization response to be equivalent to `info` from the authorization request, that should be explicitly supplied by the application from the `parse` callback.  For security reasons, `oauth2orize` shouldn't ever assume the application's original request was granted by the user.