Added 'state' to authorization response as required by RFC 6749

From RFC 6749, section 4.1.2 (http://tools.ietf.org/html/rfc6749#section-4.1.2):
      state
           REQUIRED if the "state" parameter was present in the client
           authorization request.  The exact value received from the
           client.

I've added this functionality and a test.
Done, thanks.