Assert testing for token_type is case-insensitive
Handling OAuth2 state parameters to avoid cross site request forgery.