** BC-BREAKING CHANGE ** - addresses #80: hardens default security by making 'enforce_state' param in AuthorizationServer true by default