--- a/mod_http_oauth2/mod_http_oauth2.lua	Sun Nov 22 01:54:06 2020 +0100
+++ b/mod_http_oauth2/mod_http_oauth2.lua	Sun Nov 22 01:55:42 2020 +0100
@@ -196,6 +196,7 @@
 	if not user then
 		return 401;
 	end
+	-- TODO ask user for consent here
 	if not request.url.query then
 		response.headers.content_type = "application/json";
 		return oauth_error("invalid_request");