ForbiddenError: Unable to load OAuth 2.0 transaction

I receive this error sporadically:

ForbiddenError: Unable to load OAuth 2.0 transaction: 5LDImAAY
at SessionStore.load (/opt/node/avi-on/releases/20170221135659/node_modules/oauth2orize/lib/txn/session.js:27:25)
at transactionLoader (/opt/node/avi-on/releases/20170221135659/node_modules/oauth2orize/lib/middleware/transactionLoader.js:42:24)
at Layer.handle [as handle_request] (/opt/node/avi-on/releases/20170221135659/node_modules/express/lib/router/layer.js:95:5)
at next (/opt/node/avi-on/releases/20170221135659/node_modules/express/lib/router/route.js:131:13)
at /opt/node/avi-on/releases/20170221135659/node_modules/connect-ensure-login/lib/ensureLoggedIn.js:50:5
at Layer.handle [as handle_request] (/opt/node/avi-on/releases/20170221135659/node_modules/express/lib/router/layer.js:95:5)
at next (/opt/node/avi-on/releases/20170221135659/node_modules/express/lib/router/route.js:131:13)
at Route.dispatch (/opt/node/avi-on/releases/20170221135659/node_modules/express/lib/router/route.js:112:3)
at Layer.handle [as handle_request] (/opt/node/avi-on/releases/20170221135659/node_modules/express/lib/router/layer.js:95:5)
at /opt/node/avi-on/releases/20170221135659/node_modules/express/lib/router/index.js:277:22
at Function.process_params (/opt/node/avi-on/releases/20170221135659/node_modules/express/lib/router/index.js:330:12)
at next (/opt/node/avi-on/releases/20170221135659/node_modules/express/lib/router/index.js:271:10)
at allowCrossDomain (/opt/node/avi-on/releases/20170221135659/api/index.js:32:3)
at Layer.handle [as handle_request] (/opt/node/avi-on/releases/20170221135659/node_modules/express/lib/router/layer.js:95:5)
at trim_prefix (/opt/node/avi-on/releases/20170221135659/node_modules/express/lib/router/index.js:312:13)
at /opt/node/avi-on/releases/20170221135659/node_modules/express/lib/router/index.js:280:7
at Function.process_params (/opt/node/avi-on/releases/20170221135659/node_modules/express/lib/router/index.js:330:12)
at Context.next (/opt/node/avi-on/releases/20170221135659/node_modules/express/lib/router/index.js:271:10)
at Context.actions.pass (/opt/node/avi-on/releases/20170221135659/node_modules/passport/lib/passport/context/http/actions.js:77:8)
at /opt/node/avi-on/releases/20170221135659/node_modules/passport/lib/passport/strategies/session.js:61:12
at pass (/opt/node/avi-on/releases/20170221135659/node_modules/passport/lib/passport/index.js:321:31)
at /opt/node/avi-on/releases/20170221135659/node_modules/passport/lib/passport/index.js:332:35
at [object Object]. (/opt/node/avi-on/releases/20170221135659/lib/authentication.js:21:7)
at [object Object].tryCatcher (/opt/node/avi-on/releases/20170221135659/node_modules/sequelize/node_modules/bluebird/js/release/util.js:16:23)
at Promise._settlePromiseFromHandler (/opt/node/avi-on/releases/20170221135659/node_modules/sequelize/node_modules/bluebird/js/release/promise.js:510:31)
at Promise._settlePromise (/opt/node/avi-on/releases/20170221135659/node_modules/sequelize/node_modules/bluebird/js/release/promise.js:567:18)
at Promise._settlePromise0 (/opt/node/avi-on/releases/20170221135659/node_modules/sequelize/node_modules/bluebird/js/release/promise.js:612:10)
at Promise._settlePromises (/opt/node/avi-on/releases/20170221135659/node_modules/sequelize/node_modules/bluebird/js/release/promise.js:691:18)
at Promise._fulfill (/opt/node/avi-on/releases/20170221135659/node_modules/sequelize/node_modules/bluebird/js/release/promise.js:636:18)
at Promise._resolveCallback (/opt/node/avi-on/releases/20170221135659/node_modules/sequelize/node_modules/bluebird/js/release/promise.js:431:57)
at Promise._settlePromiseFromHandler (/opt/node/avi-on/releases/20170221135659/node_modules/sequelize/node_modules/bluebird/js/release/promise.js:522:17)
at Promise._settlePromise (/opt/node/avi-on/releases/20170221135659/node_modules/sequelize/node_modules/bluebird/js/release/promise.js:567:18)
at Promise._settlePromise0 (/opt/node/avi-on/releases/20170221135659/node_modules/sequelize/node_modules/bluebird/js/release/promise.js:612:10)
at Promise._settlePromises (/opt/node/avi-on/releases/20170221135659/node_modules/sequelize/node_modules/bluebird/js/release/promise.js:691:18)
at Promise._fulfill (/opt/node/avi-on/releases/20170221135659/node_modules/sequelize/node_modules/bluebird/js/release/promise.js:636:18)
at MappingPromiseArray.PromiseArray._resolve (/opt/node/avi-on/releases/20170221135659/node_modules/sequelize/node_modules/bluebird/js/release/promise_array.js:125:19)
at MappingPromiseArray._promiseFulfilled (/opt/node/avi-on/releases/20170221135659/node_modules/sequelize/node_modules/bluebird/js/release/map.js:101:18)
at Promise._settlePromise (/opt/node/avi-on/releases/20170221135659/node_modules/sequelize/node_modules/bluebird/js/release/promise.js:572:26)
at Promise._settlePromise0 (/opt/node/avi-on/releases/20170221135659/node_modules/sequelize/node_modules/bluebird/js/release/promise.js:612:10)
at Promise._settlePromises (/opt/node/avi-on/releases/20170221135659/node_modules/sequelize/node_modules/bluebird/js/release/promise.js:691:18)
at Promise._fulfill (/opt/node/avi-on/releases/20170221135659/node_modules/sequelize/node_modules/bluebird/js/release/promise.js:636:18)

The stack trace points to node_modules/oauth2orize/lib/txn/session.js and transactionLoader.js; begin by tracing the OAuth flow around SessionStore.load. Then inspect api/index.js and lib/authentication.js, reproduce the sporadic failure, and define a regression test. Done means the missing-transaction path is explained and covered by a test.

Written by the indexing model from the issue text.