Hook for request validation in callback

`Auth0ServletCallback` lacked a method for validating the `state` parameter of the request from Auth0. This adds a `protected isValidState(String)` to allow customizing the state validation.