added better handling of the "state" query param

"state" query parameter should be used to identify the user session
this change stores user supplied session data under generated "session id" and then uses that session id as a "state" parameter