What if a $state parameter is already provided in $addtionalParameters (like I do here https://github.com/cmfcmf/OAuthModule/blob/master/Cmfcmf/OAuthModule/Api/AuthenticationApi.php#L499-L503)? Will this overwrite it with a new random value?