Support 'state' parameter in OAuth 2 flow to protect against CSRF