Remove custom String() functions, dump config in verbose logging only
Move token auth failure logging into failure handler
Code review comments
validate state, redirect inside success handler, add success handler chain