Good point too @staabm.
Probably we should put this to vote. I'm pretty indifferent about this point. IMHO we have a classic fight between code readability and efficiency.

Anyway I found out [Google suggests](https://developers.google.com/accounts/docs/OAuth2Login?hl=it#createxsrftoken) to use a 30bytes long token as `state` value.

I think another good compromise could be to simply use

```php
return md5(rand());
```

Google itself proposes this approach...

Maybe that's not extremely secure but we are talking of something that acts just as an additional CSRF token in the whole process authorization process.