Fix canvas server side authentication with signed_request

When trying to authorize using a signed_request via a canvas page submit, simply shuffling the state along to the connect_phase doesn't pass oauth2's built in csrf protection. Resulting in an invalid credentials error.

`authorize_params` already deals with this correctly and it seems like all the params that it handles should be shuffled so we can just merge those with the signed_request param to get full support of the authentication strategy.