Issue #2055325 by hswong3i: Prevent CSRF with state parameter.