Adding required(?) return_uri to OAuth2 request.

Also added a strong random 'state' variable, as a defense against cross-site request forgery attacks.
Merge pull request #79 from OpenTreeOfLife/simple-curation-app

Adding required(?) return_uri to OAuth2 request.