escape fragment to avoid double encoding params, add state variable to r...

Hi! I've been using osin for a project and ran into some issues getting it to work with hellojs (http://adodson.com/hello.js/) using an implicit grant.

The gist of it is that hellojs depends on the state parameter being returned when an implicit grant is requested. I originally added this to my Authorize Handler, but moved it to osin/authorize.go. This didn't work as I discovered the fragment was being double encoded. I did some investigation and determined that u.Fragment was the culprit.

The following changes hopefully address both issues. Please let me know if there are any issues or the changes don't make sense!

Thanks.
-Aaron