Include alpha chars in state (CSRF). Remove state once it's read from session