replaced generateCSRFToken() with generateStateToken()