Adding required(?) return_uri to OAuth2 request.

Also added a strong random 'state' variable, as a defense against cross-site request forgery attacks.