verify poll is closed before displaying ballots

resolves #1
Generate unique oauth2 state string for all login requests, redirect to last requested page on login/out

State is stored in session for verification. All old generated state strings will fail authentication.
Login/out from cached page may redirect to wrong place on login/out.

resolves #9