Add tests for OAuth state param