added 'state' to authorization response as required by RFC 6749 (section 4.1.2) + added test