use additional underscore between prefix and state in state cookie name