Ignore tokens if the state does not match

In order to protect against cross site request forgery, you should check
the state parameter matches the one returned in the fragment