[FIX] auth_oauth: quote redirect url in state

Otherwise, Firefox is splitting the state at the first &, which can potentially be located in the redict param of the state