Fix OpenID

Returns to using cookies rather than stuffing state into the URL