Req.user is sometimes a user and sometimes a client

It's confusing that req.user is a client when doing a client credentials exchange. This makes for some messy checking when we want to determine if we are working with a user model or client model.

An easy workaround that I have used is to make req.user always be a user, and put the client into req.authInfo.client. This ensures consistent access across the app.

However it creates an issue where you can't validate a client credentials exchange, because req.user is always passed into the exchange function. See https://github.com/jaredhanson/oauth2orize/blob/master/lib/exchange/clientCredentials.js#L36

Start by reading the client credentials exchange implementation at lib/exchange/clientCredentials.js, especially the exchange function referenced in the issue, and compare it with how req.user and req.authInfo.client are populated. The desired behavior is a consistent req.user contract without preventing validation of client credentials exchanges.

Written by the indexing model from the issue text.