Correct the OAuth2 state documentation