Include state parameter during authorization code grant flow