[FIX] auth_oauth: quote redirect url in state

Otherwise, Firefox is splitting the state at the first &, which can potentially be located in the redict param of the state
[FIX] auth_oauth: unquote redirect url from state

This is related to 2db6a0080f9eeac7030d6d2d856574f2192d8aa5. Looks like Firefox auto unquote, but not Chrome