def create_authorization_response(self, redirect_uri, grant_user):
    'If the resource owner grants the access request, the authorization\n        server issues an access token and delivers it to the client by adding\n        the following parameters to the fragment component of the redirection\n        URI using the "application/x-www-form-urlencoded" format.\n        Per `Section 4.2.2`_.\n\n        access_token\n             REQUIRED.  The access token issued by the authorization server.\n\n        token_type\n             REQUIRED.  The type of the token issued as described in\n             Section 7.1.  Value is case insensitive.\n\n        expires_in\n             RECOMMENDED.  The lifetime in seconds of the access token.  For\n             example, the value "3600" denotes that the access token will\n             expire in one hour from the time the response was generated.\n             If omitted, the authorization server SHOULD provide the\n             expiration time via other means or document the default value.\n\n        scope\n             OPTIONAL, if identical to the scope requested by the client;\n             otherwise, REQUIRED.  The scope of the access token as\n             described by Section 3.3.\n\n        state\n             REQUIRED if the "state" parameter was present in the client\n             authorization request.  The exact value received from the\n             client.\n\n        The authorization server MUST NOT issue a refresh token.\n\n        For example, the authorization server redirects the user-agent by\n        sending the following HTTP response:\n\n        .. code-block:: http\n\n            HTTP/1.1 302 Found\n            Location: http://example.com/cb#access_token=2YotnFZFEjr1zCsicMWpAA\n                   &state=xyz&token_type=example&expires_in=3600\n\n        Developers should note that some user-agents do not support the\n        inclusion of a fragment component in the HTTP "Location" response\n        header field.  Such clients will require using other methods for\n        redirecting the client than a 3xx redirection response -- for\n        example, returning an HTML page that includes a \'continue\' button\n        with an action linked to the redirection URI.\n\n        .. _`Section 4.2.2`: https://tools.ietf.org/html/rfc6749#section-4.2.2\n\n        :param redirect_uri: Redirect to the given URI for the authorization\n        :param grant_user: if resource owner granted the request, pass this\n            resource owner, otherwise pass None.\n        :returns: (status_code, body, headers)\n        '
    state = self.request.state
    if grant_user:
        self.request.user = grant_user
        client = self.request.client
        token = self.generate_token(client, self.GRANT_TYPE, user=grant_user, scope=client.get_allowed_scope(self.request.scope), include_refresh_token=False)
        log.debug('Grant token %r to %r', token, client)
        self.save_token(token)
        self.execute_hook('process_token', token=token)
        params = [(k, token[k]) for k in token]
        if state:
            params.append(('state', state))
        uri = add_params_to_uri(redirect_uri, params, fragment=True)
        headers = [('Location', uri)]
        return (302, '', headers)
    else:
        raise AccessDeniedError(state=state, redirect_uri=redirect_uri, redirect_fragment=True)
If the resource owner grants the access request, the authorization
server issues an access token and delivers it to the client by adding
the following parameters to the fragment component of the redirection
URI using the "application/x-www-form-urlencoded" format.
Per `Section 4.2.2`_.

access_token
     REQUIRED.  The access token issued by the authorization server.

token_type
     REQUIRED.  The type of the token issued as described in
     Section 7.1.  Value is case insensitive.

expires_in
     RECOMMENDED.  The lifetime in seconds of the access token.  For
     example, the value "3600" denotes that the access token will
     expire in one hour from the time the response was generated.
     If omitted, the authorization server SHOULD provide the
     expiration time via other means or document the default value.

scope
     OPTIONAL, if identical to the scope requested by the client;
     otherwise, REQUIRED.  The scope of the access token as
     described by Section 3.3.

state
     REQUIRED if the "state" parameter was present in the client
     authorization request.  The exact value received from the
     client.

The authorization server MUST NOT issue a refresh token.

For example, the authorization server redirects the user-agent by
sending the following HTTP response:

.. code-block:: http

    HTTP/1.1 302 Found
    Location: http://example.com/cb#access_token=2YotnFZFEjr1zCsicMWpAA
           &state=xyz&token_type=example&expires_in=3600

Developers should note that some user-agents do not support the
inclusion of a fragment component in the HTTP "Location" response
header field.  Such clients will require using other methods for
redirecting the client than a 3xx redirection response -- for
example, returning an HTML page that includes a 'continue' button
with an action linked to the redirection URI.

.. _`Section 4.2.2`: https://tools.ietf.org/html/rfc6749#section-4.2.2

:param redirect_uri: Redirect to the given URI for the authorization
:param grant_user: if resource owner granted the request, pass this
    resource owner, otherwise pass None.
:returns: (status_code, body, headers)
def create_authorization_response(self, redirect_uri, grant_user):
    'If the resource owner grants the access request, the authorization\n        server issues an access token and delivers it to the client by adding\n        the following parameters to the fragment component of the redirection\n        URI using the "application/x-www-form-urlencoded" format.\n        Per `Section 4.2.2`_.\n\n        access_token\n             REQUIRED.  The access token issued by the authorization server.\n\n        token_type\n             REQUIRED.  The type of the token issued as described in\n             Section 7.1.  Value is case insensitive.\n\n        expires_in\n             RECOMMENDED.  The lifetime in seconds of the access token.  For\n             example, the value "3600" denotes that the access token will\n             expire in one hour from the time the response was generated.\n             If omitted, the authorization server SHOULD provide the\n             expiration time via other means or document the default value.\n\n        scope\n             OPTIONAL, if identical to the scope requested by the client;\n             otherwise, REQUIRED.  The scope of the access token as\n             described by Section 3.3.\n\n        state\n             REQUIRED if the "state" parameter was present in the client\n             authorization request.  The exact value received from the\n             client.\n\n        The authorization server MUST NOT issue a refresh token.\n\n        For example, the authorization server redirects the user-agent by\n        sending the following HTTP response:\n\n        .. code-block:: http\n\n            HTTP/1.1 302 Found\n            Location: http://example.com/cb#access_token=2YotnFZFEjr1zCsicMWpAA\n                   &state=xyz&token_type=example&expires_in=3600\n\n        Developers should note that some user-agents do not support the\n        inclusion of a fragment component in the HTTP "Location" response\n        header field.  Such clients will require using other methods for\n        redirecting the client than a 3xx redirection response -- for\n        example, returning an HTML page that includes a \'continue\' button\n        with an action linked to the redirection URI.\n\n        .. _`Section 4.2.2`: https://tools.ietf.org/html/rfc6749#section-4.2.2\n\n        :param redirect_uri: Redirect to the given URI for the authorization\n        :param grant_user: if resource owner granted the request, pass this\n            resource owner, otherwise pass None.\n        :returns: (status_code, body, headers)\n        '
    state = self.request.state
    if grant_user:
        self.request.user = grant_user
        client = self.request.client
        token = self.generate_token(client, self.GRANT_TYPE, user=grant_user, scope=client.get_allowed_scope(self.request.scope), include_refresh_token=False)
        log.debug('Grant token %r to %r', token, client)
        self.save_token(token)
        self.execute_hook('process_token', token=token)
        params = [(k, token[k]) for k in token]
        if state:
            params.append(('state', state))
        uri = add_params_to_uri(redirect_uri, params, fragment=True)
        headers = [('Location', uri)]
        return (302, , headers)
    else:
        raise AccessDeniedError(state=state, redirect_uri=redirect_uri, redirect_fragment=True)