store oauth state in cookie to verify it corresponds to current client
Merge branch 'rkh-check-state'