separate read/publish permissions and state in getLoginUrl

* separate read/publish permissions
* added `state` in `getLoginUrl`