Cookie and state size optimization

Trimmed the size of the state by requiring the target to have an implied
context.  This will also increase security as it prevents arbitrary
redirects.

Refactored secret key calculation to occur once only.