Allowing client to optionally specify state key

Quick tweak to the OAuth2 authorize method to allow the client to specify the state key instead of always generating a new GUID.