Changes to oAuth callback and state verification

Hi, 

I found that the window.postMessage wasn't always working, so a replaced it with just a global scope function (yeah, I know is not that elegant, but it is a bit more compatible), and I added state verification, which is actually sent to the token endpoint and then verified upon callback. 

Let me know what you think.  

Cheers