Implement state provider for OAuth2 protocol

Currently, to prevent the client for CSRF attacks as described in the [OAuth2 RFC](https://tools.ietf.org/html/rfc6749#section-10.12), the OAuth2 provider stores the state on the application side in the cache. So when using a clustered environment a distributed cache instance must be used. This pull request removes this cache dependency in favor of an abstract solution to handle the state on applications side. It comes with a session state provider that can store the state in the session to follow Play's stateless approach.
Yes, that make sense