Add state generation and check

The `state`parameter, even though optional, it is strongly recommended to prevent attacks such as cross-site request forgery. A good way to encourage its use is by adding it to the auth examples.