add other providers (like facebook)

e.g.

t
    .route('/auth/facebook/callback/:id', function (req, resp) {
        if (req.qs.code) {
          setFacebookCode(req.qs.code, function (e) {
            if (e) return resp.error(e)
            token.redirect(resp)
          })
        } else if (req.qs.access_token) {
          // Something bad happened and the redirect url was followed.
          // Hopefully it's just our own client and we can return the expected body
          resp.end(qs.stringify(req.qs))
        } else {
          logger.error('WHY!')
          // TODO find error
        }
    })

function setFacebookCode(code, cb) {
    var self = this
      , q =
        { code: code
        , client_id: this.client.facebook_client_id
        , client_secret: this.client.facebook_client_secret
        // eventually needs to use subdomain
        , redirect_uri: baseURL + 'auth/facebook/callback/'+self._id 
        }
      ;
    // It's important to know that this doesn't forward to the redirect uri
    request.get('https://graph.facebook.com/oauth/access_token?'+qs.stringify(q), function (e, r, body) {
      if (e) return cb(e)
      if (r.statusCode !== 200) return cb(new ServiceError('Error: '+body))
      self.setFacebookToken(qs.parse(body), cb)
    })
  }

Start with the /auth/facebook/callback/:id route and setFacebookCode example, then inspect the existing GitHub OAuth entry point. Done means an agreed additional provider can complete its callback and token exchange, including defined error behavior.