Fix csrf error with omniauth-oauth2 1.1 when using canvas signed_request

... info for auth

When we hit /auth/facebook with signed_request_data and redirect directly
to /auth/facebook/callback, we need to pass along the "state" set by omniauth oauth2 CSRF protection

Like https://github.com/mkdynamic/omniauth-facebook/pull/97, but passing along only `state` parameter and fixing the tests.