Ignore tokens if the state does not match

In order to protect against cross site request forgery, you should check the state parameter matches the one returned in the fragment.
@andreareginato no - in that you shouldn't need that beforeEach clause, but I haven't had a chance to look into what's happening, sorry