Implicit Token - https request but http response!

Nobody has claimed this yet.

I am attempting to implement an Implicit Token and it's almost all working except the very last, the response with token.

In lib/token.js, I've added some extra debug statements to see if the actual redirect URI was wrong, however it clearly isn't as can be seen here just prior to the redirect at the end of the `function issued(err, accessToken, params)` function in `grant/token.js`...

``` javascript
debug("TOKEN response success and redirect issued to %s ", location);
return res.redirect(location);
```

shows the folloing in the console...

``` javascript
oauth2orize TOKEN response success and redirect issued to https://localhost:4000/dashboard#access_token=u3AxxV9Gy05Izmw...YKt5KaKFEEDfL&token_type=bearer
```

However my browser (Chrome) dev tool console indicates:

``` javascript
The page at https://localhost:4000/oauth/authorize?response_type=token&client_id=v10data_dashboard&redirect_uri=https://localhost:4000/dashboard displayed insecure content from http://localhost:4000/dashboard#access_token=MYZZjI0jD2…E8RWGRc6S&token_type=bearer.
```

The location to the `https://localhost:4000/oauth/dialog/authorize/decision` is clearly set to (note HTTP and not HTTPS):

``` javascript
location:http://localhost:4000/dashboard#access_token=MYZZjI0jD2...E8RWGRc6S&token_type=bearer
```

I'm just at a loss here since this is simply a redirect clearly with the url going to HTTPS when actually the browser claims HTTP. Is there something somewhere I can include to further investigate?

The setup, which I doubt causes this since all other responses and redirects work is a node.js + node-https-proxy service serving an authentication, resource and dashboard servers where the authentication server is running node.js + express.js + locomotive.js and oauth2orize 0.1.0.

Note: I've shortened the token `...` to reduce the description, it's a 256 token.

here is the full req/res from chrome dev console

``` javascript
Request URL:https://localhost:4000/oauth/dialog/authorize/decision
Request Method:POST
Status Code:302 Moved Temporarily
Request Headersview source
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-US,en;q=0.8
Cache-Control:max-age=0
Connection:keep-alive
Content-Length:35
Content-Type:application/x-www-form-urlencoded
Cookie:splashShown1.6=1; undefined=0; csrftoken=tuY3Uoh3DDfctJ92Hbjq1070072ZNwXl; user=%7B%22username%22%3A%22%22%2C%22role%22%3A%7B%22bitMask%22%3A1%2C%22title%22%3A%22public%22%7D%7D; connect.sess=s%3Aj%3A%7B%22passport%22%3A%7B%22user%22%3A1%7D%2C%22authorize%22%3A%7B%22mxVALdZO%22%3A%7B%22protocol%22%3A%22oauth2%22%2C%22client%22%3A6%2C%22redirectURI%22%3A%22https%3A%2F%2Flocalhost%3A4000%2Fdashboard%22%2C%22req%22%3A%7B%22type%22%3A%22token%22%2C%22clientID%22%3A%22v10data_dashboard%22%2C%22redirectURI%22%3A%22%2Fdashboard%22%7D%7D%2C%22GeheVvt0%22%3A%7B%22protocol%22%3A%22oauth2%22%2C%22client%22%3A6%2C%22redirectURI%22%3A%22https%3A%2F%2Flocalhost%3A4000%2Fdashboard%22%2C%22req%22%3A%7B%22type%22%3A%22token%22%2C%22clientID%22%3A%22v10data_dashboard%22%2C%22redirectURI%22%3A%22%2Fdashboard%22%7D%7D%2C%22c6jF6vWI%22%3A%7B%22protocol%22%3A%22oauth2%22%2C%22client%22%3A6%2C%22redirectURI%22%3A%22https%3A%2F%2Flocalhost%3A4000%2Fdashboard%22%2C%22req%22%3A%7B%22type%22%3A%22token%22%2C%22clientID%22%3A%22v10data_dashboard%22%2C%22redirectURI%22%3A%22https%3A%2F%2Flocalhost%3A4000%2Fdashboard%22%7D%7D%2C%22khAyzWov%22%3A%7B%22protocol%22%3A%22oauth2%22%2C%22client%22%3A6%2C%22redirectURI%22%3A%22https%3A%2F%2Flocalhost%3A4000%2Fdashboard%22%2C%22req%22%3A%7B%22type%22%3A%22token%22%2C%22clientID%22%3A%22v10data_dashboard%22%2C%22redirectURI%22%3A%22https%3A%2F%2Flocalhost%3A4000%2Fdashboard%22%7D%7D%7D%7D.rnK3GERYzBlrWVs1zVYnic3dV5fhlNUemgndiOmk5xc
Host:localhost:4000
Origin:https://localhost:4000
Referer:https://localhost:4000/oauth/authorize?response_type=token&client_id=v10data_dashboard&redirect_uri=https://localhost:4000/dashboard
User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.65 Safari/537.36
Form Dataview sourceview URL encoded
transaction_id:khAyzWov
allow:allow

Response Headers

connection:keep-alive
content-length:704
content-type:text/html
date:Fri, 13 Sep 2013 23:24:00 GMT
location:http://localhost:4000/dashboard#access_token=DUG0MO9EkCmqC7ldthULbjNXmIDybXsRJGkm6sA85jWoYnRnZx6ItfsHRv9et805GMIwVzghkGe5N605TTthdM5QX1elddWho9nYSYltgidMVoavNhUPZjDcDC4oh2zX0QB0NnBR5HRY5CMSAYC0P2dB2n6IxFw1pouUFl08CMAtSZXugTjwo77PbxPYChGsCgvAhrVmD5TSg1V9fwEjS7W4FLxUO0hXwFCaeA5RYeKOHgOrhdw1HcfXf2zzabR3&token_type=bearer
set-cookie:connect.sess=s%3Aj%3A%7B%22passport%22%3A%7B%22user%22%3A1%7D%2C%22authorize%22%3A%7B%22mxVALdZO%22%3A%7B%22protocol%22%3A%22oauth2%22%2C%22client%22%3A6%2C%22redirectURI%22%3A%22https%3A%2F%2Flocalhost%3A4000%2Fdashboard%22%2C%22req%22%3A%7B%22type%22%3A%22token%22%2C%22clientID%22%3A%22v10data_dashboard%22%2C%22redirectURI%22%3A%22%2Fdashboard%22%7D%7D%2C%22GeheVvt0%22%3A%7B%22protocol%22%3A%22oauth2%22%2C%22client%22%3A6%2C%22redirectURI%22%3A%22https%3A%2F%2Flocalhost%3A4000%2Fdashboard%22%2C%22req%22%3A%7B%22type%22%3A%22token%22%2C%22clientID%22%3A%22v10data_dashboard%22%2C%22redirectURI%22%3A%22%2Fdashboard%22%7D%7D%2C%22c6jF6vWI%22%3A%7B%22protocol%22%3A%22oauth2%22%2C%22client%22%3A6%2C%22redirectURI%22%3A%22https%3A%2F%2Flocalhost%3A4000%2Fdashboard%22%2C%22req%22%3A%7B%22type%22%3A%22token%22%2C%22clientID%22%3A%22v10data_dashboard%22%2C%22redirectURI%22%3A%22https%3A%2F%2Flocalhost%3A4000%2Fdashboard%22%7D%7D%7D%7D.lqvvNpe6fEPub7aJyA4kZV2ws7ihNZf%2Bi0pYopLEV90; Path=/; HttpOnly
vary:Accept
x-powered-by:Express
```

OH and BTW, amazing package guys, really! Going through Python, Ruby, PHP etc, node.js package quality such as yours made me completely change my ways!

Start in lib/token.js and grant/token.js, especially the issued(err, accessToken, params) redirect path, then compare the generated location with the HTTP Location response header from /oauth/dialog/authorize/decision. Reproduce the implicit-token flow through the node-https-proxy setup and determine where the HTTPS redirect becomes HTTP; done means the response preserves the registered HTTPS redirect URI.

Written by the indexing model from the issue text.