if (locals) {
        req.oauth2.locals = req.oauth2.locals || {};
        _.merge(req.oauth2.locals, locals);
      }