[4.1] Fixed bug with not filtering state from callback URL

So after trying to do some real-world tests with the new URL detection stuff, it looks like Facebook will return the following error if the `state` param is not filtered from the `redirect_uri` in the callback:

> Error validating verification code. Please make sure your redirect_uri is identical to the one you used in the OAuth dialog request

So this PR fixes this by removing just the `state` param and nothing else.

It also includes more explicit CSRF checks and throws an `FacebookSDKException` when CSRF validation fails.

It also includes getters for the error responses. So now handling failed logins can be more explicit.

```php
$helper = $fb->getRedirectLoginHelper();
$facebookClient = $fb->getClient();

try {
  $accessToken = $helper->getAccessToken($facebookClient);
} catch(FacebookResponseException $e) {
  // When Graph returns an error
  echo 'Graph returned an error: ' . $e->getMessage();
  exit;
} catch(FacebookSDKException $e) {
  // When validation fails or other local issues
  echo 'Facebook SDK returned an error: ' . $e->getMessage();
  exit;
}

// Not logged in - user rejected or some other reason
if ( ! isset($accessToken)) {
  echo "<p>Error: " . $helper->getError() . "</p>\n\n";
  echo "<p>Error Code: " . $helper->getErrorCode() . "</p>\n\n";
  echo "<p>Error Reason: " . $helper->getErrorReason() . "</p>\n\n";
  echo "<p>Error Description: " . $helper->getErrorDescription() . "</p>\n\n";
  exit;
}

// Logged in
var_dump($accessToken);
```

Oh yeah, I also removed `loadState()` and `storeState()` since the new way to overwrite those is with the `PersistentDataInterface`. Forgot to kill those in that PR. :)