Revert omniauth to use state only in production