Review comment: comment and validate in computeClientState.
Review comment: extract TokenFetchResourceDelegate.
Review comment: an awful hacky test for X-Client-State header.