Added basic state check to workflow example

Wonder why need of state check is not even mentioned in readme
Right. But take a look at whole "auth code flow" block, not just this diff. Exception here would look extraneous near [Oh dear](https://github.com/thephpleague/oauth2-client/blame/master/README.md#L76) and echo's.
So we should either rewrite code block completely (maybe in separate commit) or just leave it as is, shouldn't we? This is just a quick dirty example after all.