remove favicon link
make state parameter generated by uuid
add jump handler and page for jumping out and redirecting
use oauth in iframe