Log state, state_from_session, is_csrf from oauth2 callback