anchor.diff:              // client id and client secret must be in the basic header. Check them
               clientId := request.AuthUsername;
               clientSecret := request.AuthPassword;
  +            if (clientId = '') and (clientSecret = '') then // R support
  +            begin
  +              clientId := params.getVar('client_id');
  +              clientSecret := params.getVar('client_secret');
  +            end;
               if clientId <> pclientid then
                 raise EAuthClientException.create('Client Id is wrong ("'+clientId+'") in Authorization Header');
               if clientSecret <> client.secret then
  
positive.code:     except
        on e : EAuthClientException do
        begin
          if e.FLocation = '' then
          begin
            response.ResponseNo := 400;
            response.ResponseText := 'Bad Request';
  
negative.code: 
        session.scopes := scopes.CommaText.Replace(',', ' ');
        ServerContext.Storage.RegisterConsentRecord(session);
        if redirect = 'urn:ietf:wg:oauth:2.0:oob' then
        begin
          response.ResponseNo := 200;
          response.ResponseText := 'OK';
          response.ContentText := 'Redirect Code is not valid redirect? ('+redirect+') - Authorization code: '+session.OuterToken;
        end
        else
          response.Redirect(redirect+'?code='+session.OuterToken+'&state='+state);
      finally
        scopes.Free;
      end;
  