Removes some unused code sections that already get defined in parent class. Adds csrf functionality back in. State is now check in both regular omniauth flow and oauthio. Note that the same state is used for both. I do not think this creates a security problem but requires further investigation.