clear attrs when request teardown
since refresh token handler and access token handler are the same, merge them
fix test cases
remove session on authorization flow. add test for state parameters