generate state as part of authorize_params