pull state as session UUID from OAuth URL