Added support for state in web server auth flow