interface: restrict empty auth redirect_uri
interface: permit optional csrf state in auth url