Authenticator accepts a state parameter

Should we use something else as our state example? Using the `redirect_uri` could be confusing to future readers.