Fix csrf error with omniauth-oauth2 1.1 when using canvas signed_request info for auth

When we hit /auth/facebook with signed_request_data and redirect directly
to /auth/facebook/callback, we need to pass along the "state" set by omniauth oauth2 CSRF protection