Add state param to authenticate(), make it work for OAuth2.
Add state param for OAuth1.
Add `applicationSecret` param to OAuth2Provider constructor

Remove from OAuth2Settings.