Check state param in oauth callback