Ignore tokens if the state does not match

In order to protect against cross site request forgery, you should check the state parameter matches the one returned in the fragment.
Removed this - otherwise we could add to directive parameters too (so they still match), but figured a blank parameters case was worth testing too