Add opts param to session#authroize_url to enable CSRF protection.
Use different method instead of opts for state param.
Use optional state param.
Cleanup session spec.
minor edits to spec.
Replace SSL 3 with TLS 1.2

With SSL 3 POODLE issue (CVE 2014-3566) ssl_version set to :SSLv3 raises an exception:

    OpenSSL::SSL::SSLError: SSL_connect returned=1 errno=0 state=SSLv3 read server hello A: sslv3 alert handshake failure

With ssl_version set to :TLSv1_2 Box connection works as expected.