Fix to a bug which would cause the 'state' token to be regenerated and not expired/deleted when a valid 'code' token is return through th oAuth logon process.  The 'state' token should persist until a 'code' token has been returned and invalidated at that time - see getAuthorizationCode().

 Cause: Calling getUserId() would indirectly invalidate (delete) the tokens when getting the user 'access_token' via calling getUserAccessToken().