Fix OAuth flow: pass back state param if present
Fix: App can fetch itself via app credentials