Implement oauth state attribute

use state attr if defined, otherwise default to current location.  QS params were also not encoded.