Add state verification on callback

The state paramater is currently neither validated nor passed to the application. This parameter is crucial in avoiding [CSRF-attacks](http://tools.ietf.org/html/rfc6749#section-10.12).

This commit should compare the state parameter from the strategy configuration with the received state parameter from the Google endpoint.