URL encoded State

Occasionally, there were issues with the returns from the oAuth server where the state couldn't be parsed correctly by the SDK. This was related to the state (a base64 encoded string) which sometimes included padding (not always, as the request is pretty uniform most of the times), thus adding '=' signs at the end of the string.
These signs were url encoded on the callback to the app, but were not properly decoded before the attempt at base64_decode happened. This still worked fine, but the later attempt at json_decode the result would barf due to the trailing garbage left by the base64_decode.

This fix addresses that issue by properly decoding the State before any attempt to use it.