Added the `next` callback method argument for controller methods.

Be a better middleware by calling `next()` when work is complete.
Specifically: after the response has been sent.
Support server option `flushResponse` for flushing response body.

When this option is set to a truthy value, the response body created
by the oauth2 provider will be sent. Otherwise, the response data
will simply be attached to the `response.locals` object.