Maybe I'm misunderstanding something, but the `state` param should be a random string, right? It's only being hardcoded here because it's the easy thing to do.