 			next()
 
 		# oauth: get access token from server
-		env.server.post env.config.base + '/auth/access_token', (req, res, next) ->
+		env.server.post env.config.base + '/auth/access_token', middlewares_connectauth_chain, (req, res, next) ->
 			e = new env.utilities.check.Error
 			e.check req.body, code: env.utilities.check.format.key, key: env.utilities.check.format.key, secret: env.utilities.check.format.key
 

				env.data.states.get stateid, (err, state) ->
					return next err if err
					return next new env.utilities.check.Error 'state', 'invalid or expired' if not state
					callback = clientCallback state:state.options.state, provider:state.provider, redirect_uri:state.redirect_uri, origin:state.origin, redirect_type:state.redirect_type, req, res, next
					return callback new env.utilities.check.Error 'state', 'code already sent, please use /access_token' if state.step != "0"
					async.parallel [
							(cb) -> env.data.providers.getExtended state.provider, cb
							(cb) -> env.data.apps.getKeyset state.key, state.provider, cb
					], (err, r) =>
						return callback err if err
						provider = r[0]
						parameters = r[1].parameters
						response_type = r[1].response_type
						oa = new env.utilities.oauth[state.oauthv](provider, parameters)
						oa.access_token state, req, (e, r) ->
							status = if e then 'error' else 'success'
							env.callhook 'connect.auth', req, res, (err) ->
								return callback err if err
								env.events.emit 'connect.callback', req:req, origin:state.origin, key:state.key, provider:state.provider, parameters:state.options?.parameters, status:status
								return callback e if e

								env.callhook 'connect.backend', results:r, key:state.key, provider:state.provider, status:status, (e) ->
									return callback e if e


									# If not client side mode, store the tokens
									if state.options.client_type != 'client'
										env.data.states.set stateid, token:JSON.stringify(r), step:1, (->)

									# Always delete refresh token from front-end response
									delete r.refresh_token

									# If server_side only, remove everything and put the code
									if response_type == 'code'
										r = {}

									# If a state was given by client, give him only the code
									if state.options.client_type != 'client'
										r.code = stateid

									# Remove the state from db for client_side mode
									if state.options.client_type == 'client'
										env.data.states.del stateid, (->)

									callback null, r, response_type

		# oauth: popup or redirection to provider's authorization url
		env.server.get env.config.base + '/auth/:provider', (req, res, next) ->

						oa.refresh req.body.token, keyset, env.send(res,next)

		# iframe injection for IE
		env.server.get env.config.base + '/auth/iframe', middlewares_connectauth_chain, (req, res, next) ->
			res.setHeader 'Content-Type', 'text/html'
			res.setHeader 'p3p', 'CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"'
			e = new env.utilities.check.Error
