if (locals) {
              req.oauth2.locals = req.oauth2.locals || {};
              _.merge(req.oauth2.locals, locals);
            }