Don't expect/send state through to OAuth server.
Return info/extra hashes directly, no need to recompose them.