encode state parameter when creating AUTH urls