[CBSER-32] use STATE to identify oauth2 request