Added option to skip replacing the state.

When writing an application that makes use of some frameworks, touching the window.history/location is not encouraged, and might cause undesired side effects. As such, I've added an option to skip replacing the state when getting the callback from the auth server. This means that the URL will still have the parameters sent by the auth server when the option `skipReplaceState` is set to `false`. For all other cases (non-existing property, or set to anything else), it's the same behavior as before this commit.